diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dadc748..ee97def 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,11 +18,11 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
         with:
-          go-version: '1.26.5'
+          go-version: '1.26.8'
 
       - name: Install system tools
         run: |
@@ -38,7 +38,7 @@ jobs:
       - name: Install goneat via sfetch (dogfooding)
         run: |
           ./bin/sfetch --repo fulmenhq/goneat \
-            --tag v0.5.15 \
+            --tag v0.6.0 \
             --dest-dir bin \
             --require-minisign
           ./bin/goneat version
@@ -90,7 +90,7 @@ jobs:
           - os: windows-latest-arm64-s
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
 
       - name: Setup sfetch via composite action (v0.4.11 minisig route)
         uses: ./.github/actions/setup-sfetch
@@ -163,7 +163,7 @@ jobs:
     container:
       image: ubuntu:24.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
 
       - name: Install prerequisites
         shell: bash
@@ -173,9 +173,9 @@ jobs:
             apt-get install -y --no-install-recommends \
             ca-certificates git minisign
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
         with:
-          go-version: '1.26.5'
+          go-version: '1.26.8'
 
       - name: Build sfetch (from this commit)
         shell: bash
@@ -194,7 +194,7 @@ jobs:
           export PATH="$BIN_DIR:$PATH"
 
           sfetch --repo fulmenhq/goneat \
-            --tag v0.5.15 \
+            --tag v0.6.0 \
             --dest-dir "$BIN_DIR" \
             --cache-dir "$CACHE_DIR" \
             --require-minisign
@@ -205,11 +205,11 @@ jobs:
     name: Windows dogfood (x64)
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
         with:
-          go-version: '1.26.5'
+          go-version: '1.26.8'
 
       # Pinned official minisign 0.12 archive (no Chocolatey/winget).
       - name: Install pinned minisign 0.12
@@ -230,7 +230,7 @@ jobs:
         run: |
           .\bin\sfetch.exe `
             --repo fulmenhq/goneat `
-            --tag v0.5.15 `
+            --tag v0.6.0 `
             --dest-dir bin `
             --require-minisign
           .\bin\goneat.exe version
@@ -239,11 +239,11 @@ jobs:
     name: Windows dogfood (arm64)
     runs-on: windows-latest-arm64-s
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
         with:
-          go-version: '1.26.5'
+          go-version: '1.26.8'
 
       # Pinned official minisign 0.12 archive (no Chocolatey/winget).
       - name: Install pinned minisign 0.12
@@ -275,7 +275,7 @@ jobs:
         run: |
           .\bin\sfetch.exe `
             --repo fulmenhq/goneat `
-            --tag v0.5.15 `
+            --tag v0.6.0 `
             --dest-dir bin `
             --require-minisign
           .\bin\goneat.exe version
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3f63f48..08f541e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ jobs:
   create_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
 
       # softprops/action-gh-release@v3 (Node 24) replaces the archived,
       # Node12-era actions/create-release@v1 + actions/upload-release-asset@v1
@@ -29,7 +29,7 @@ jobs:
       # via make release-upload. A published release without installer .minisig is
       # non-consumable for verified bootstrap; draft keeps it off "latest".
       - name: Create draft release and upload install script
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64  # v3.0.3
         with:
           name: sfetch ${{ github.ref_name }}
           body: |
@@ -60,7 +60,7 @@ jobs:
           - goos: windows
             goarch: arm64
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
 
       - name: Validate VERSION matches tag
         run: |
@@ -74,9 +74,9 @@ jobs:
             exit 1
           fi
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
         with:
-          go-version: '1.26.5'
+          go-version: '1.26.8'
 
       - name: License check
         # go-licenses v1.6.0 errors on stdlib packages ("Package fmt does not
@@ -131,7 +131,7 @@ jobs:
       # action-gh-release@v3 is idempotent on the tag; parallel matrix jobs each
       # upload a distinctly-named asset, so no upload_url plumbing is needed.
       - name: Upload Archive
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64  # v3.0.3
         with:
           files: ${{ env.ASSET_FILE }}
 
diff --git a/Makefile b/Makefile
index 181f7b0..5086f84 100644
--- a/Makefile
+++ b/Makefile
@@ -46,8 +46,8 @@ BIN_DIR := $(CURDIR)/bin
 # never "latest" and never the in-flight cut — so main CI cannot 404 during the
 # tag/upload window. Advance after each release publishes + signs.
 SFETCH_VERSION := v0.4.11
-GONEAT_VERSION ?= v0.5.15
-GOVULNCHECK_VERSION ?= v1.6.0
+GONEAT_VERSION ?= v0.6.0
+GOVULNCHECK_VERSION ?= v1.8.0
 
 # Tool paths (sfetch bootstrap may land in bin/; goneat must be on PATH)
 SFETCH = $(shell [ -x "$(BIN_DIR)/sfetch" ] && echo "$(BIN_DIR)/sfetch" || command -v sfetch 2>/dev/null)
diff --git a/docs/cicd-usage-guide.md b/docs/cicd-usage-guide.md
index 63f2f03..3e60ccf 100644
--- a/docs/cicd-usage-guide.md
+++ b/docs/cicd-usage-guide.md
@@ -42,7 +42,7 @@ supported `sfetch-version` range for that SHA and fails closed outside it.
 - uses: 3leaps/sfetch/.github/actions/setup-sfetch@<commit-sha>
   with:
     sfetch-version: v0.4.11          # exact tag; never latest
-    goneat-version: v0.5.15          # optional; exact tag if set
+    goneat-version: v0.6.0           # optional; exact tag if set
   env:
     GITHUB_TOKEN: ${{ github.token }}
     GH_TOKEN: ${{ github.token }}
@@ -146,7 +146,7 @@ jobs:
     container:
       image: golang:1.23
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
       - uses: 3leaps/sfetch/.github/actions/setup-sfetch@<commit-sha>
         with:
           sfetch-version: v0.4.11
@@ -183,7 +183,7 @@ jobs:
       # Match the GitHub-hosted runner workspace ownership (UID 1001)
       options: --user 1001
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
       - uses: 3leaps/sfetch/.github/actions/setup-sfetch@<commit-sha>
         with:
           sfetch-version: v0.4.11
@@ -264,7 +264,7 @@ In CI, you can:
 
 ```yaml
 - name: Cache sfetch downloads
-  uses: actions/cache@v4
+  uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4.3.0
   with:
     path: ~/.cache/sfetch
     key: sfetch-${{ runner.os }}-${{ hashFiles('.tool-versions') }}
diff --git a/go.mod b/go.mod
index cfc8ed8..f9f537b 100644
--- a/go.mod
+++ b/go.mod
@@ -1,17 +1,17 @@
 module github.com/3leaps/sfetch
 
-go 1.25.12
+go 1.26.0
 
-toolchain go1.26.5
+toolchain go1.26.8
 
 require (
 	github.com/jedisct1/go-minisign v0.0.0-20260527172527-a09352b57a22
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
 )
 
 require (
 	github.com/dlclark/regexp2 v1.12.0 // indirect
-	golang.org/x/crypto v0.54.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/crypto v0.57.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 21e1388..dd1add7 100644
--- a/go.sum
+++ b/go.sum
@@ -2,11 +2,11 @@ github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz
 github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/jedisct1/go-minisign v0.0.0-20260527172527-a09352b57a22 h1:C68TAi+k12EKJCAmsdaERzQ22ZxVE6n+CuB3kOkhQ7c=
 github.com/jedisct1/go-minisign v0.0.0-20260527172527-a09352b57a22/go.mod h1:vYVVh81Lqe/TP0sPLjiNYcX9Hxy/YSfkUx96lYJeyKo=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
diff --git a/scripts/bootstrap-sfetch-verified.sh b/scripts/bootstrap-sfetch-verified.sh
index 5def5d2..9793f65 100755
--- a/scripts/bootstrap-sfetch-verified.sh
+++ b/scripts/bootstrap-sfetch-verified.sh
@@ -11,7 +11,7 @@
 #
 # Usage:
 #   bootstrap-sfetch-verified.sh --version v0.4.11 --dir ~/.local/bin
-#   bootstrap-sfetch-verified.sh --version v0.4.10 --dir ./bin --goneat-version v0.5.15
+#   bootstrap-sfetch-verified.sh --version v0.4.10 --dir ./bin --goneat-version v0.6.0
 #   bootstrap-sfetch-verified.sh --acquire-minisign-only --dir PATH
 #
 # No runtime env overrides for trust-critical paths (download base, minisign
diff --git a/scripts/test-bootstrap-sfetch-verified.sh b/scripts/test-bootstrap-sfetch-verified.sh
index b1c650d..9cb3077 100755
--- a/scripts/test-bootstrap-sfetch-verified.sh
+++ b/scripts/test-bootstrap-sfetch-verified.sh
@@ -460,7 +460,7 @@ STUB
     mkdir -p "$GONEAT_DIR"
     set +e
     OUT_GO="$WORKDIR/out-goneat-offline.txt"
-    "$GONEAT_ENG" --version v0.4.11 --dir "$GONEAT_DIR" --goneat-version v0.5.15 >"$OUT_GO" 2>&1
+    "$GONEAT_ENG" --version v0.4.11 --dir "$GONEAT_DIR" --goneat-version v0.6.0 >"$OUT_GO" 2>&1
     RC=$?
     set -e
     [ "$RC" -ne 0 ] || fail "goneat install failure must fail closed (log: $(cat "$OUT_GO"))"