diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 91e4fe76..cc486d3c 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -28,4 +28,4 @@ jobs:
     name: actionlint
     permissions:
       contents: read
-    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/actionlint.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
+    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/actionlint.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0
diff --git a/.github/workflows/claude-cli-drift.yml b/.github/workflows/claude-cli-drift.yml
index 5d33b1e0..90bab513 100644
--- a/.github/workflows/claude-cli-drift.yml
+++ b/.github/workflows/claude-cli-drift.yml
@@ -35,7 +35,7 @@ jobs:
       contents: read
     steps:
       - name: Harden runner (egress block + explicit allowlist)
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -48,10 +48,10 @@ jobs:
             nodejs.org:443
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: 22
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 73f378f7..a16a3ab9 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -42,6 +42,6 @@ jobs:
       fail-fast: false
       matrix:
         language: ['python', 'actions']
-    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/public-codeql.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
+    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/public-codeql.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0
     with:
       languages: '["${{ matrix.language }}"]'
diff --git a/.github/workflows/cross-platform.yml b/.github/workflows/cross-platform.yml
index 1656c90e..9a606240 100644
--- a/.github/workflows/cross-platform.yml
+++ b/.github/workflows/cross-platform.yml
@@ -30,7 +30,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
-    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/cross-platform-smoke.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
+    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/cross-platform-smoke.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0
     with:
       os_list: '["${{ matrix.os }}"]'
       timeout_minutes: 10
diff --git a/.github/workflows/dependency-check.yml b/.github/workflows/dependency-check.yml
index d0098cf9..0db72196 100644
--- a/.github/workflows/dependency-check.yml
+++ b/.github/workflows/dependency-check.yml
@@ -30,7 +30,7 @@ jobs:
       contents: read
     steps:
       - name: Harden runner (egress block + explicit allowlist)
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
         with:
           egress-policy: block
           # probe_mcp_upstream.py queries 4 registries: npm, PyPI, Homebrew, Dart.
@@ -49,10 +49,10 @@ jobs:
             storage.googleapis.com:443
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.13'
 
@@ -89,7 +89,7 @@ jobs:
       contents: read
     steps:
       - name: Harden runner (egress block + explicit allowlist)
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -102,10 +102,10 @@ jobs:
             pypi.org:443
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.13'
 
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 86d5bd6a..dfa8aced 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -26,6 +26,6 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/public-dependency-review.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
+    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/public-dependency-review.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0
     with:
       fail_on_severity: moderate
diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
index d2a45a93..2cdeff5d 100644
--- a/.github/workflows/gitleaks.yml
+++ b/.github/workflows/gitleaks.yml
@@ -31,7 +31,7 @@ jobs:
     name: gitleaks scan
     permissions:
       contents: read
-    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/secret-scan.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
+    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/secret-scan.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0
     with:
       report_format: sarif
       report_path: gitleaks-report.sarif
diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml
index 1793c126..ca4d7923 100644
--- a/.github/workflows/pytest.yml
+++ b/.github/workflows/pytest.yml
@@ -44,7 +44,7 @@ jobs:
     steps:
       - name: Harden runner (egress block + explicit allowlist)
         if: runner.os == 'Linux'  # harden-runner is Linux-only (per ADR-0010)
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -57,12 +57,12 @@ jobs:
             pypi.org:443
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
           cache: 'pip'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0b32806a..a37a92a6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,7 +45,7 @@ jobs:
             exit 1
           fi
       - name: Harden runner (egress block + explicit allowlist)
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -67,7 +67,7 @@ jobs:
             tuf-repo-cdn.sigstore.dev:443
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0  # need full history for tag verification
           persist-credentials: false
@@ -134,12 +134,12 @@ jobs:
           echo "RELEASE_VERSION=$release_version" >> "$GITHUB_ENV"
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: 22
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.13'
 
@@ -242,12 +242,12 @@ jobs:
           retention-days: 30
 
       - name: Attest release evidence bundle
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763  # v4.1.1
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6  # v4.2.0
         with:
           subject-path: release-evidence.tgz
 
       - name: Attest generated SBOM
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763  # v4.1.1
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6  # v4.2.0
         with:
           subject-path: release-evidence/sbom.spdx.json
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 47d5c561..bab0eb92 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -20,6 +20,6 @@ jobs:
       id-token: write
       contents: read
       actions: read
-    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/public-scorecard-json.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
+    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/public-scorecard-json.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0
     with:
       publish_results: false
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index f1bf941a..19028da1 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -30,7 +30,7 @@ jobs:
       contents: read
     steps:
       - name: Harden runner (egress block + explicit allowlist)
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -45,10 +45,10 @@ jobs:
             pypi.org:443
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: 22
 
@@ -92,7 +92,7 @@ jobs:
     steps:
       - name: Harden runner (egress block + explicit allowlist)
         if: runner.os == 'Linux'  # harden-runner is Linux-only (per ADR-0010)
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -111,12 +111,12 @@ jobs:
             developers.openai.com:443
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.13'