diff --git a/.github/workflows/docker-build-cloud.yml b/.github/workflows/docker-build-cloud.yml
index 5f08c85..1927572 100644
--- a/.github/workflows/docker-build-cloud.yml
+++ b/.github/workflows/docker-build-cloud.yml
@@ -49,7 +49,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Login MUST run before Set up Docker Buildx so the cloud driver can
       # authenticate to the Docker Build Cloud endpoint via ~/.docker/config.json.
@@ -60,14 +60,14 @@ jobs:
           password: ${{ secrets.dockerhub-password }}
 
       - name: Set up Docker Buildx (Docker Build Cloud)
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
         with:
           driver: cloud
           endpoint: ${{ inputs.cloud-builder-endpoint }}
 
       - name: Build and push multi-platform image
         id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           build-args: ${{ inputs.build-args }}
           context: ${{ inputs.context }}
@@ -80,7 +80,7 @@ jobs:
       # Requires the permissions id-token: write + attestations: write.
       - name: Generate & sign SLSA provenance (keyless)
         if: ${{ inputs.attest }}
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-name: ${{ inputs.image-name }}
           subject-digest: ${{ steps.build.outputs.digest }}
diff --git a/.github/workflows/java-build.yml b/.github/workflows/java-build.yml
index 16ae96d..c48b590 100644
--- a/.github/workflows/java-build.yml
+++ b/.github/workflows/java-build.yml
@@ -67,7 +67,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Sonar needs the full history to attribute lines to authors, and the Gradle
           # build derives the project version from the tag pointing at HEAD.
diff --git a/.github/workflows/propose-safe-multisig-tx.yml b/.github/workflows/propose-safe-multisig-tx.yml
index 96d9a0f..499b20c 100644
--- a/.github/workflows/propose-safe-multisig-tx.yml
+++ b/.github/workflows/propose-safe-multisig-tx.yml
@@ -51,12 +51,12 @@ jobs:
     
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: iExecBlockchainComputing/github-actions-workflows
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
 
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 8ff7caf..b228b55 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -109,7 +109,7 @@ jobs:
           scope: ${{ inputs.scope }}
 
       - name: Enable Socket Firewall
-        uses: SocketDev/action@be1f253a41351d59095f8d7f1425985097dd1054 # unreleased: pre-v1.3.2, includes shim feature
+        uses: SocketDev/action@be1f253a41351d59095f8d7f1425985097dd1054 # unreleased: post-v1.3.2, includes sfw shims
         with:
           mode: firewall-free
           shims: true
diff --git a/.github/workflows/rust-build.yml b/.github/workflows/rust-build.yml
index c82e9e9..d5941bd 100644
--- a/.github/workflows/rust-build.yml
+++ b/.github/workflows/rust-build.yml
@@ -32,16 +32,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # @master 2026-09-04 (action has no version tags)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # @master 2026-09-12 (action has no version tags)
         with:
           toolchain: ${{ inputs.rust-version }}
           components: clippy, rustfmt
 
       - name: Enable Socket Firewall
-        uses: SocketDev/action@be1f253a41351d59095f8d7f1425985097dd1054
+        uses: SocketDev/action@be1f253a41351d59095f8d7f1425985097dd1054 # unreleased: post-v1.3.2, includes sfw shims
         with:
           mode: firewall-free
           shims: true
@@ -49,7 +49,7 @@ jobs:
       # https://github.com/actions/cache/blob/main/examples.md#rust---cargo
       - name: Cache dependencies
         if: ${{ inputs.enable-cache }}
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/bin/
diff --git a/docker-build-cloud/workflow-sha256 b/docker-build-cloud/workflow-sha256
index 146b5cb..a6e0c67 100644
--- a/docker-build-cloud/workflow-sha256
+++ b/docker-build-cloud/workflow-sha256
@@ -1 +1 @@
-f364b67e9d5c3795461d15b7bab21adddcd63490e097a15aa82678f80212bff4
+9534ee4ca0e3ac583e44e73291978c1f83349585535e39fe1fe4804f651baee4
diff --git a/java-build/workflow-sha256 b/java-build/workflow-sha256
index 504e8e2..05e353f 100644
--- a/java-build/workflow-sha256
+++ b/java-build/workflow-sha256
@@ -1 +1 @@
-0cfcab0eef18565a49557ca272394093e9d8d2a45dd09407b037f1ee0268f701
+7613d95bab42ba3dee3574df0bf3e43059b96720aedb0f5560d3f4b7e92e2aed
diff --git a/propose-safe-multisig-tx/workflow-sha256 b/propose-safe-multisig-tx/workflow-sha256
index e3b8d0f..b67026b 100644
--- a/propose-safe-multisig-tx/workflow-sha256
+++ b/propose-safe-multisig-tx/workflow-sha256
@@ -1 +1 @@
-2bc401eb56f124daf40536e5e7c2b46f93a6dc11752d05984d2031df30207b8b
+20270bfd49e14744aac321cd791e23f25aff4e36df2176bb9fb3eb52047cc624
diff --git a/publish-npm/workflow-sha256 b/publish-npm/workflow-sha256
index b15ca9f..fc7348a 100644
--- a/publish-npm/workflow-sha256
+++ b/publish-npm/workflow-sha256
@@ -1 +1 @@
-ec4d71529317633973e1487f89ce98e6f8abe43718a260de00b73156c56cd5d2
+07eaef487e580e8c16e82a532f0b271b645bb733c1c3fc37899dedfab9936c13
diff --git a/rust-build/workflow-sha256 b/rust-build/workflow-sha256
index b1796ad..1beb714 100644
--- a/rust-build/workflow-sha256
+++ b/rust-build/workflow-sha256
@@ -1 +1 @@
-e26af861c1aabbbc1d5468e9153f8e1bb1878713ce4ae501f7aaff3626008bdc
+cc034c9a999a64610979272458e185e098b3a288bbe41cd267a577bff679135a