diff --git a/.github/workflows/_bazel.yml b/.github/workflows/_bazel.yml
index 2be7b0e900..180990f52a 100644
--- a/.github/workflows/_bazel.yml
+++ b/.github/workflows/_bazel.yml
@@ -64,7 +64,7 @@ jobs:
         inputs.action == 'build'
         && inputs.bazel-path == 'bazel'
         && inputs.upload
-      uses: envoyproxy/toolshed/actions/source@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/source@05dcb996bb8a087a88eb7627e05f99f327f8830b
       with:
         output-name: toolshed-bazel-v{version}.tar.gz
         source-path: bazel/
@@ -72,7 +72,7 @@ jobs:
         version-file: bazel/VERSION.txt
     - name: Bazel source
       if: ${{ steps.source-tarball.outputs.tarball }}
-      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
       with:
         name: bazel-source
         path: ${{ steps.source-tarball.outputs.tarball }}
@@ -83,7 +83,7 @@ jobs:
         inputs.action == 'build'
         && inputs.artifacts
         && inputs.upload
-      uses: envoyproxy/toolshed/actions/jq@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
       with:
         input: ${{ inputs.artifacts }}
         input-format: text
@@ -93,7 +93,7 @@ jobs:
           | "${{ inputs.bazel-path }}/bazel-bin/\(.)"
     - name: Bazel artifacts
       if: ${{ inputs.upload && (steps.artifact-paths.outputs.value || steps.source-tarball.outputs.tarball) }}
-      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
       with:
         name: bazel-artifacts
         path: |
diff --git a/.github/workflows/_bazel_registry.yml b/.github/workflows/_bazel_registry.yml
index 9905838722..469a653f5d 100644
--- a/.github/workflows/_bazel_registry.yml
+++ b/.github/workflows/_bazel_registry.yml
@@ -40,7 +40,7 @@ jobs:
       versions: ${{ steps.versions.outputs.value }}
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-    - uses: envoyproxy/toolshed/actions/jq@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: versions
       with:
         input: ${{ inputs.modules-root }}/modules/${{ inputs.module }}/${{ inputs.metadata }}
@@ -62,12 +62,12 @@ jobs:
         version: ${{ fromJSON(needs.module.outputs.versions) }}
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-    - uses: envoyproxy/toolshed/actions/jq@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
       with:
         input: ${{ inputs.modules-root }}/modules/${{ inputs.module }}/${{ matrix.version }}/${{ inputs.source }}
         input-format: json-path
         print-result: true
-    - uses: envoyproxy/toolshed/actions/bson@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: source
       with:
         input: ${{ inputs.modules-root }}/modules/${{ inputs.module }}/${{ matrix.version }}/${{ inputs.source }}
@@ -84,7 +84,7 @@ jobs:
           split("\n")
           | map(select(length > 0) | split(" ") | {key: .[0], value: .[1]})
           | from_entries
-    - uses: envoyproxy/toolshed/actions/bson@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
       with:
         input: ${{ inputs.modules-root }}/modules/${{ inputs.module }}/${{ matrix.version }}/${{ inputs.source }}
         input-format: json-path
diff --git a/.github/workflows/_publish_release.yml b/.github/workflows/_publish_release.yml
index 322973bc74..13b5d181b7 100644
--- a/.github/workflows/_publish_release.yml
+++ b/.github/workflows/_publish_release.yml
@@ -73,7 +73,7 @@ jobs:
     name: release (${{ inputs.name }})
     runs-on: ubuntu-24.04
     steps:
-    - uses: envoyproxy/toolshed/actions/appauth@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/appauth@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: appauth
       name: Appauth
       if: >-
@@ -84,7 +84,7 @@ jobs:
         key: ${{ secrets.app-key }}
     - id: checkout
       name: Checkout the repository
-      uses: envoyproxy/toolshed/actions/github/checkout@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/github/checkout@05dcb996bb8a087a88eb7627e05f99f327f8830b
       with:
         branch: main
         committer-name: ${{ inputs.committer-name }}
@@ -106,13 +106,13 @@ jobs:
       id: gpg
       if: >-
         inputs.artifacts
-      uses: envoyproxy/toolshed/actions/gpg@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/gpg@05dcb996bb8a087a88eb7627e05f99f327f8830b
       with:
         gpg-key: ${{ ! inputs.dry-run && secrets.gpg-key || '' }}
         gpg-password: ${{ ! inputs.dry-run && secrets.gpg-password || '' }}
     - name: Release title (eg commit message)
       id: title
-      uses: envoyproxy/toolshed/actions/jq@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
       with:
         options: -sRr
         input: |
@@ -121,7 +121,7 @@ jobs:
           split("\n") | first
 
     - name: Publish the release
-      uses: envoyproxy/toolshed/actions/github/release@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/github/release@05dcb996bb8a087a88eb7627e05f99f327f8830b
       with:
         artifact-workflows: ${{ inputs.artifact-workflows }}
         artifacts: ${{ inputs.artifacts }}
diff --git a/.github/workflows/_release.yml b/.github/workflows/_release.yml
index a617300dcb..0af55120e3 100644
--- a/.github/workflows/_release.yml
+++ b/.github/workflows/_release.yml
@@ -80,7 +80,7 @@ jobs:
     name: ${{ inputs.action }}
     runs-on: ubuntu-24.04
     steps:
-    - uses: envoyproxy/toolshed/actions/appauth@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/appauth@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: appauth
       name: Appauth
       if: >-
@@ -90,7 +90,7 @@ jobs:
         key: ${{ secrets.app-key }}
     - id: checkout
       name: Checkout the repository
-      uses: envoyproxy/toolshed/actions/github/checkout@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/github/checkout@05dcb996bb8a087a88eb7627e05f99f327f8830b
       with:
         branch: main
         committer-name: ${{ inputs.committer-name }}
@@ -99,7 +99,7 @@ jobs:
         token: ${{ steps.appauth.outputs.token }}
     - name: Get version file
       id: version-file
-      uses: envoyproxy/toolshed/actions/jq@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
       with:
         input: |
           actions: actions/VERSION.txt
@@ -111,11 +111,11 @@ jobs:
         filter: .["${{ inputs.type }}"]
     - name: Get version info
       id: version
-      uses: envoyproxy/toolshed/actions/version@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/version@05dcb996bb8a087a88eb7627e05f99f327f8830b
       with:
         version-file: ${{ steps.version-file.outputs.value }}
     - name: Update version file
-      uses: envoyproxy/toolshed/actions/bson@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
       if: >-
         inputs.action != 'prepare'
       with:
@@ -148,7 +148,7 @@ jobs:
 
     # BAZEL ONLY
     - name: Get latest bins release (for bazel)
-      uses: envoyproxy/toolshed/actions/github/release/latest@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/github/release/latest@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: bins-version
       if: >-
         inputs.type == 'bazel'
@@ -156,7 +156,7 @@ jobs:
       with:
         pattern: ^bins-
     - name: Get SHAs for latest bins release (for bazel)
-      uses: envoyproxy/toolshed/actions/github/release/shas@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/github/release/shas@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: bins-shas
       if: >-
         inputs.type == 'bazel'
@@ -164,7 +164,7 @@ jobs:
       with:
         tag: ${{ steps.bins-version.outputs.tag }}
     - name: Get current SHAs and version (for bazel)
-      uses: envoyproxy/toolshed/actions/bson@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: bins-deps
       if: >-
         inputs.type == 'bazel'
@@ -179,7 +179,7 @@ jobs:
           bash::output
         options: -sRr
     - name: Update bins shas (for bazel)
-      uses: envoyproxy/toolshed/actions/bson@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: bins-updates
       if: >-
         inputs.type == 'bazel'
@@ -264,7 +264,7 @@ jobs:
       if: >-
         inputs.type == 'python'
         && inputs.action != 'release-no-prepare'
-      uses: envoyproxy/toolshed/actions/bson@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
       with:
         input: |
           ${{ inputs.python-find-versions }}
@@ -281,7 +281,7 @@ jobs:
         inputs.type == 'python'
         && inputs.action != 'release-no-prepare'
       name: Update python release packages
-      uses: envoyproxy/toolshed/actions/bson@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
       with:
         input: |
           args: >-
@@ -303,7 +303,7 @@ jobs:
       if: >-
         inputs.type == 'python'
         && inputs.action != 'release-no-prepare'
-      uses: envoyproxy/toolshed/actions/bson@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
       with:
         input: |
           ${{ inputs.python-find-versions }}
@@ -349,7 +349,7 @@ jobs:
         echo "message=${COMMIT_MESSAGE}" >> "$GITHUB_OUTPUT"
         echo "changes=true" >> "$GITHUB_OUTPUT"
     - name: Create Pull Request
-      uses: envoyproxy/toolshed/actions/github/pr@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/github/pr@05dcb996bb8a087a88eb7627e05f99f327f8830b
       if: fromJSON(steps.commit.outputs.changes)
       with:
         base: main
diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml
index 3608ecae1e..48aaf584b3 100644
--- a/.github/workflows/actions.yml
+++ b/.github/workflows/actions.yml
@@ -21,7 +21,7 @@ jobs:
       run: ${{ steps.filter.outputs.run }}
       tests: ${{ steps.tests.outputs.output }}
     steps:
-    - uses: envoyproxy/toolshed/actions/github/should-run@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/github/should-run@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: filter
       with:
         config: |
@@ -30,7 +30,7 @@ jobs:
           - 'js/**'
           - '.github/workflows/actions.yml'
     - id: tests
-      uses: envoyproxy/toolshed/actions/bson@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
       with:
         input: |
           OUTPUT="$(find actions -path "*/tests/*.test.yml" -type f)"
@@ -53,7 +53,7 @@ jobs:
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
     - name: Run test
-      uses: envoyproxy/toolshed/actions/test-runner@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/test-runner@05dcb996bb8a087a88eb7627e05f99f327f8830b
       with:
         config: ${{ matrix.test }}
         name: ${{ matrix.test }}
diff --git a/.github/workflows/bazel-registry.yml b/.github/workflows/bazel-registry.yml
index 4840706b64..f8c3bdbcec 100644
--- a/.github/workflows/bazel-registry.yml
+++ b/.github/workflows/bazel-registry.yml
@@ -21,7 +21,7 @@ jobs:
       run: ${{ steps.filter.outputs.run }}
       modules: ${{ steps.modules.outputs.output }}
     steps:
-    - uses: envoyproxy/toolshed/actions/github/should-run@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/github/should-run@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: filter
       with:
         config: |
@@ -31,7 +31,7 @@ jobs:
           - .github/workflows/_bazel_registry.yml
           - .github/workflows/registry_integrity.sh
     - name: Find modules
-      uses: envoyproxy/toolshed/actions/bson@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+      uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: modules
       with:
         input: |
diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml
index b8bcc00ae3..088b1f175a 100644
--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -20,7 +20,7 @@ jobs:
     outputs:
       run: ${{ steps.filter.outputs.run }}
     steps:
-    - uses: envoyproxy/toolshed/actions/github/should-run@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/github/should-run@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: filter
       with:
         config: |
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f97179f788..8581771f33 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -42,15 +42,15 @@ jobs:
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6  # v4.32.3
+      uses: github/codeql-action/init@c793b717bc78562f491db7b0e93a3a178b099162  # v4.32.5
       with:
         languages: ${{ matrix.language }}
         config-file: ./.github/codeql/codeql-config.yml
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@9e907b5e64f6b83e7804b09294d44122997950d6  # v4.32.3
+      uses: github/codeql-action/autobuild@c793b717bc78562f491db7b0e93a3a178b099162  # v4.32.5
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6  # v4.32.3
+      uses: github/codeql-action/analyze@c793b717bc78562f491db7b0e93a3a178b099162  # v4.32.5
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 37bb003662..ec996571d5 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -21,7 +21,7 @@ jobs:
     outputs:
       run: ${{ steps.filter.outputs.run }}
     steps:
-    - uses: envoyproxy/toolshed/actions/github/should-run@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/github/should-run@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: filter
       with:
         config: |
@@ -72,7 +72,7 @@ jobs:
       shell: bash
 
     - name: Upload OCI artifacts
-      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
       with:
         name: oci-debian-${{ matrix.arch }}
         path: docker/build/oci-output/*.tar
diff --git a/.github/workflows/jq.yml b/.github/workflows/jq.yml
index fe9f189f2d..4d8ff108f3 100644
--- a/.github/workflows/jq.yml
+++ b/.github/workflows/jq.yml
@@ -20,7 +20,7 @@ jobs:
     outputs:
       run: ${{ steps.filter.outputs.run }}
     steps:
-    - uses: envoyproxy/toolshed/actions/github/should-run@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/github/should-run@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: filter
       with:
         config: |
diff --git a/.github/workflows/js.yml b/.github/workflows/js.yml
index 330d0ad584..b355688f46 100644
--- a/.github/workflows/js.yml
+++ b/.github/workflows/js.yml
@@ -20,7 +20,7 @@ jobs:
     outputs:
       run: ${{ steps.filter.outputs.run }}
     steps:
-    - uses: envoyproxy/toolshed/actions/github/should-run@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/github/should-run@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: filter
       with:
         config: |
diff --git a/.github/workflows/publishing.yml b/.github/workflows/publishing.yml
index 2d62c13fa2..9ec1d45be6 100644
--- a/.github/workflows/publishing.yml
+++ b/.github/workflows/publishing.yml
@@ -19,7 +19,7 @@ jobs:
       run: ${{ steps.filter.outputs.run }}
       sha: ${{ steps.commit.outputs.sha }}
     steps:
-    - uses: envoyproxy/toolshed/actions/github/should-run@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/github/should-run@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: filter
       with:
         config: |
diff --git a/.github/workflows/py.yml b/.github/workflows/py.yml
index 3d839553a1..12eaf198be 100644
--- a/.github/workflows/py.yml
+++ b/.github/workflows/py.yml
@@ -22,7 +22,7 @@ jobs:
     outputs:
       run: ${{ steps.filter.outputs.run }}
     steps:
-    - uses: envoyproxy/toolshed/actions/github/should-run@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/github/should-run@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: filter
       with:
         config: |
@@ -57,7 +57,7 @@ jobs:
     - name: Run pants test
       run: "pants --colors test ::"
     - name: Archive code coverage results
-      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
       with:
         name: coverage
         path: dist/coverage/python/htmlcov/
@@ -137,7 +137,7 @@ jobs:
     - name: Run pants package
       run: "pants --colors package ::"
     - name: Archive created packages
-      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
       with:
         name: python-artifacts
         path: dist/*whl
diff --git a/.github/workflows/releasing.yml b/.github/workflows/releasing.yml
index fb1c40480b..4a975c5d80 100644
--- a/.github/workflows/releasing.yml
+++ b/.github/workflows/releasing.yml
@@ -19,7 +19,7 @@ jobs:
       run: ${{ steps.filter.outputs.run }}
       sha: ${{ steps.commit.outputs.sha }}
     steps:
-    - uses: envoyproxy/toolshed/actions/github/should-run@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/github/should-run@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: filter
       with:
         config: |
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 808ba6c7df..ac0ac0e465 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -21,7 +21,7 @@ jobs:
     outputs:
       run: ${{ steps.filter.outputs.run }}
     steps:
-    - uses: envoyproxy/toolshed/actions/github/should-run@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/github/should-run@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: filter
       with:
         config: |
@@ -48,7 +48,7 @@ jobs:
     name: test (${{ matrix.toolchain }}, ${{ matrix.test-type }})
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-    - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c  # v1
+    - uses: actions-rust-lang/setup-rust-toolchain@a0b538fa0b742a6aa35d6e2c169b4bd06d225a98  # v1
       with:
         toolchain: ${{ matrix.toolchain }}
     - name: Install cargo-tarpaulin
@@ -84,7 +84,7 @@ jobs:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
     - name: Install Rust toolchain
-      uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c  # v1
+      uses: actions-rust-lang/setup-rust-toolchain@a0b538fa0b742a6aa35d6e2c169b4bd06d225a98  # v1
       with:
         toolchain: stable
 
@@ -107,7 +107,7 @@ jobs:
         cp rust/target/release/glint glint-${{ steps.version.outputs.version }}-${{ matrix.arch }}
 
     - name: Upload glint binary
-      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
       with:
         name: rust-artifacts-glint-${{ steps.version.outputs.version }}-${{ matrix.arch }}
         path: glint-${{ steps.version.outputs.version }}-${{ matrix.arch }}
@@ -132,7 +132,7 @@ jobs:
         cp rust/target/release/toolshed-echo echo-${{ steps.echo-version.outputs.version }}-${{ matrix.arch }}
 
     - name: Upload echo binary
-      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
       with:
         name: rust-artifacts-echo-${{ steps.echo-version.outputs.version }}-${{ matrix.arch }}
         path: echo-${{ steps.echo-version.outputs.version }}-${{ matrix.arch }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index cf9b0331d0..3aaadd2d13 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -37,13 +37,13 @@ jobs:
         publish_results: true
 
     - name: "Upload artifact"
-      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
       with:
         name: SARIF file
         path: results.sarif
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@9e907b5e64f6b83e7804b09294d44122997950d6  # v4.32.3
+      uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162  # v4.32.5
       with:
         sarif_file: results.sarif
diff --git a/.github/workflows/sh.yml b/.github/workflows/sh.yml
index 7cb67a3355..3cd22210cb 100644
--- a/.github/workflows/sh.yml
+++ b/.github/workflows/sh.yml
@@ -20,7 +20,7 @@ jobs:
     outputs:
       run: ${{ steps.filter.outputs.run }}
     steps:
-    - uses: envoyproxy/toolshed/actions/github/should-run@8bcc8dc6d3fc28d318e66e1121162cd8bc1d3197
+    - uses: envoyproxy/toolshed/actions/github/should-run@05dcb996bb8a087a88eb7627e05f99f327f8830b
       id: filter
       with:
         config: |
diff --git a/actions/azp/agent-cleanup/action.yml b/actions/azp/agent-cleanup/action.yml
index cc8583b318..bf9ff87617 100644
--- a/actions/azp/agent-cleanup/action.yml
+++ b/actions/azp/agent-cleanup/action.yml
@@ -21,13 +21,13 @@ runs:
 
   - id: fetch
     name: Fetch AZP agents list
-    uses: envoyproxy/toolshed/actions/fetch@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/fetch@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       url: https://dev.azure.com/${{ inputs.azp-org }}/_apis/distributedtask/pools/${{ inputs.pool-id }}/agents?api-version=7.1-preview.1
       args: -u ":${{ inputs.azp-token }}"
 
   - name: Get dead AZP agent ids
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input-format: json-path
       input: ${{ steps.fetch.outputs.path }}
diff --git a/actions/bind-mounts/action.yml b/actions/bind-mounts/action.yml
index fb3da798cf..2533ef55f8 100644
--- a/actions/bind-mounts/action.yml
+++ b/actions/bind-mounts/action.yml
@@ -23,7 +23,7 @@ runs:
   using: composite
   steps:
   - name: Bind mount directories
-    uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: mount
     with:
       input: ${{ inputs.mounts }}
diff --git a/actions/bson/action.yml b/actions/bson/action.yml
index ee7914ae4b..a3d08e667f 100644
--- a/actions/bson/action.yml
+++ b/actions/bson/action.yml
@@ -48,7 +48,7 @@ runs:
       chmod +x $TMPFILE
       echo "path=$TMPFILE" >> $GITHUB_OUTPUT
     shell: bash
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: command
     with:
       input: ${{ inputs.input }}
@@ -76,7 +76,7 @@ runs:
       TMPFILE: ${{ steps.script.outputs.path }}
     shell: bash
   - id: output
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     if: ${{ inputs.result-filter }}
     with:
       input: ${{ steps.run.outputs.output }}
diff --git a/actions/buildah/action.yml b/actions/buildah/action.yml
index 08f50b6bde..1bcde9fe13 100644
--- a/actions/buildah/action.yml
+++ b/actions/buildah/action.yml
@@ -65,7 +65,7 @@ runs:
       echo '${{ inputs.gcr-key }}' | base64 -d | buildah login --username _json_key --password-stdin gcr.io
       echo "::endgroup::"
   - name: Execute buildah operations
-    uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: execute
     with:
       title: Execute buildah operations
diff --git a/actions/cache/prime/action.yml b/actions/cache/prime/action.yml
index de230c97f4..664b93098a 100644
--- a/actions/cache/prime/action.yml
+++ b/actions/cache/prime/action.yml
@@ -70,7 +70,7 @@ runs:
     id: gcs-object
     if: >-
       inputs.cache-type == 'gcs'
-    uses: envoyproxy/toolshed/actions/gcs/cache/exists@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/gcs/cache/exists@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       bucket: ${{ inputs.gcs-bucket }}
       key: ${{ inputs.key }}
@@ -78,7 +78,7 @@ runs:
     id: artifact-object
     if: >-
       inputs.cache-type == 'artifact'
-    uses: envoyproxy/toolshed/actions/github/artifact/cache/id@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/github/artifact/cache/id@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       name: ${{ inputs.key }}
       wf-path: ${{ inputs.artifact-wf-path }}
@@ -94,7 +94,7 @@ runs:
       key: ${{ inputs.key }}
 
   # Mutex
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     if: >-
       ! inputs.lock-id
       && steps.cache-restore-initial.outputs.cache-hit != 'true'
@@ -106,7 +106,7 @@ runs:
       options: -Rr
       filter: |
         @base64
-  - uses: envoyproxy/toolshed/actions/github/mutex@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/github/mutex@05dcb996bb8a087a88eb7627e05f99f327f8830b
     if: >-
       inputs.lock-token
       && steps.cache-restore-initial.outputs.cache-hit != 'true'
@@ -134,7 +134,7 @@ runs:
     if: >-
       inputs.cache-type == 'artifact'
       && steps.artifact-object.outputs.exists == ''
-    uses: envoyproxy/toolshed/actions/github/artifact/cache/id@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/github/artifact/cache/id@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       name: ${{ inputs.key }}
       wf-path: ${{ inputs.artifact-wf-path }}
@@ -143,7 +143,7 @@ runs:
     if: >-
       inputs.cache-type == 'gcs'
       && steps.gcs-object.outputs.exists != 'true'
-    uses: envoyproxy/toolshed/actions/gcs/cache/exists@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/gcs/cache/exists@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       bucket: ${{ inputs.gcs-bucket }}
       key: ${{ inputs.key }}
@@ -210,7 +210,7 @@ runs:
   - if: >-
       steps.restore.outputs.save == 'true'
       && inputs.gcs-bucket
-    uses: envoyproxy/toolshed/actions/gcs/cache/save@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/gcs/cache/save@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       bucket: ${{ inputs.gcs-bucket }}
       key: ${{ inputs.key }}
@@ -220,7 +220,7 @@ runs:
     if: >-
       steps.restore.outputs.save == 'true'
       && inputs.cache-type == 'artifact'
-    uses: envoyproxy/toolshed/actions/github/artifact/cache/save@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/github/artifact/cache/save@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       name: ${{ inputs.artifact-name }}
       path: ${{ inputs.path || inputs.path-tmp }}
diff --git a/actions/cache/restore/action.yml b/actions/cache/restore/action.yml
index 8b1d7c755d..62021531db 100644
--- a/actions/cache/restore/action.yml
+++ b/actions/cache/restore/action.yml
@@ -72,7 +72,7 @@ runs:
     if: >-
       inputs.cache-type == 'gcs'
     id: cache-restore-gcs
-    uses: envoyproxy/toolshed/actions/gcs/cache/restore@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/gcs/cache/restore@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       bucket: ${{ inputs.gcs-bucket }}
       path: ${{ inputs.path || inputs.path-tmp }}
@@ -81,7 +81,7 @@ runs:
     if: >-
       inputs.cache-type == 'artifact'
     id: cache-restore-artifact
-    uses: envoyproxy/toolshed/actions/github/artifact/cache/restore@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/github/artifact/cache/restore@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       id: ${{ inputs.artifact-id }}
       name: ${{ inputs.artifact-name }}
diff --git a/actions/docker/cache/prime/action.yml b/actions/docker/cache/prime/action.yml
index 929258b6c5..754712ae68 100644
--- a/actions/docker/cache/prime/action.yml
+++ b/actions/docker/cache/prime/action.yml
@@ -21,7 +21,7 @@ outputs:
 runs:
   using: "composite"
   steps:
-  - uses: envoyproxy/toolshed/actions/cache/prime@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/cache/prime@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: prime
     with:
       key: ${{ inputs.image-tag }}${{ inputs.key-suffix }}
diff --git a/actions/docker/cache/restore/action.yml b/actions/docker/cache/restore/action.yml
index ac7d6135ea..ce63063fbf 100644
--- a/actions/docker/cache/restore/action.yml
+++ b/actions/docker/cache/restore/action.yml
@@ -18,7 +18,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-  - uses: envoyproxy/toolshed/actions/cache/restore@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/cache/restore@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       key: ${{ inputs.image-tag }}${{ inputs.key-suffix }}
       command: |
diff --git a/actions/docker/fetch/action.yml b/actions/docker/fetch/action.yml
index 05d5964d4a..473e5c807e 100644
--- a/actions/docker/fetch/action.yml
+++ b/actions/docker/fetch/action.yml
@@ -13,7 +13,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-  - uses: envoyproxy/toolshed/actions/fetch@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/fetch@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: fetch
     with:
       url: ${{ inputs.url }}
diff --git a/actions/docker/shas/action.yml b/actions/docker/shas/action.yml
index 61627f1f36..7b9aa83747 100644
--- a/actions/docker/shas/action.yml
+++ b/actions/docker/shas/action.yml
@@ -14,12 +14,12 @@ outputs:
 runs:
   using: composite
   steps:
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: yaml
     with:
       input: ${{ inputs.images }}
       input-format: yaml
-  - uses: envoyproxy/toolshed/actions/foreach@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/foreach@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: json_actions
     with:
       items: ${{ steps.yaml.outputs.value }}
@@ -31,7 +31,7 @@ runs:
               %{{ fromJSON(inputs.context).items['$KEY'] }}
             env_var: ${{ inputs.env_prefix }}_$KEY
 
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: images
     with:
       input: ${{ steps.json_actions.outputs.out }}
diff --git a/actions/envoy/ci/env/action.yml b/actions/envoy/ci/env/action.yml
index beacf8ba44..7a17e122f0 100644
--- a/actions/envoy/ci/env/action.yml
+++ b/actions/envoy/ci/env/action.yml
@@ -52,7 +52,7 @@ runs:
   steps:
 
   # Check current/requested config (currently only build-images can be overridden)
-  - uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: config
     with:
       title: fetch ${{ inputs.branch-name }}:${{ inputs.config-file }}
@@ -70,7 +70,7 @@ runs:
       result-filter: .
 
   - id: build-images
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input-format: yaml-path
       input: ${{ inputs.config-file }}
@@ -86,7 +86,7 @@ runs:
         | {$requested}
 
   # Check request version
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Validate given version string
     id: version
     with:
@@ -105,7 +105,7 @@ runs:
         | {requested: .}
 
   - id: request
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input: |
         actor: ${{ toJSON(github.actor) }}
@@ -138,12 +138,12 @@ runs:
 
   - name: Run config
     id: run-config
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input-format: yaml
       input: ${{ toJSON(fromJSON(steps.config.outputs.output).run) }}
 
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Create data
     id: data
     with:
diff --git a/actions/envoy/ci/request/action.yml b/actions/envoy/ci/request/action.yml
index e96a2fc031..020d3a0bce 100644
--- a/actions/envoy/ci/request/action.yml
+++ b/actions/envoy/ci/request/action.yml
@@ -69,7 +69,7 @@ runs:
   #
   # Only specified bots are trusted.
   - id: trusted
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input: |
         trusted_bots: |
@@ -87,7 +87,7 @@ runs:
         | (. and ($input.event_name | startswith("pull_request") | not))
 
   # Check requested changes
-  - uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: changed
     with:
       title: git diff changes from ${{ inputs.merge-commit || 'HEAD^1' }}
@@ -108,7 +108,7 @@ runs:
         | split("\n")
 
   # Check current/requested config (currently only build-images can be overridden)
-  - uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: config
     with:
       title: fetch ${{ inputs.branch-name }}:${{ inputs.config-file }}
@@ -128,7 +128,7 @@ runs:
       result-filter: .
 
   - id: build-images
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input-format: yaml-path
       input: ${{ inputs.working-directory }}/${{ inputs.config-file }}
@@ -151,7 +151,7 @@ runs:
         | {$requested, current: .}
 
   # Check current/request versions
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Validate given version string
     id: version-string
     with:
@@ -160,7 +160,7 @@ runs:
       input: ${{ inputs.working-directory }}/VERSION.txt
       filter: |
         validate::version
-  - uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: version
     with:
       title: fetch ${{ inputs.branch-name }}:${{ inputs.version-file }}
@@ -192,7 +192,7 @@ runs:
         | {requested: ., current: $current}
 
   - id: request
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input: |
         actor: ${{ toJSON(github.actor) }}
@@ -240,18 +240,18 @@ runs:
 
   - name: Run config
     id: run-config
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input-format: yaml
       input: ${{ toJSON(fromJSON(steps.config.outputs.output).run) }}
-  - uses: envoyproxy/toolshed/actions/torun@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/torun@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: torun
     with:
       event: ${{ github.event_name }}
       config: ${{ steps.run-config.outputs.value }}
       paths: ${{ steps.changed.outputs.output || '[]' }}
 
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Create data
     id: data
     with:
diff --git a/actions/envoy/run/summary/action.yml b/actions/envoy/run/summary/action.yml
index f4a0ea0e54..d712269d21 100644
--- a/actions/envoy/run/summary/action.yml
+++ b/actions/envoy/run/summary/action.yml
@@ -113,12 +113,12 @@ inputs:
 runs:
   using: composite
   steps:
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     if: ${{ fromJSON(env.CI_DEBUG || 'false') && true || false }}
     with:
       input: ${{ inputs.context }}
       print-result: true
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Runtime information
     id: run-info
     with:
@@ -135,13 +135,13 @@ runs:
          completed: .run.completed,
          "run-time": "\(.run.completed - .run.started | . * 100 | round / 100)s",
          "job-time": "\(.run.completed - .context["job-started"] | . * 100 | round / 100)s"}
-  - uses: envoyproxy/toolshed/actions/json/table@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/json/table@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Run information summary
     id: run-summary
     with:
       json: ${{ steps.run-info.outputs.value }}
       title: Runtime information
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input: ${{ inputs.context }}
       options: -r
diff --git a/actions/foreach/action.yml b/actions/foreach/action.yml
index 4a3bbfb3ba..ebe2f1810d 100644
--- a/actions/foreach/action.yml
+++ b/actions/foreach/action.yml
@@ -25,7 +25,7 @@ outputs:
 runs:
   using: composite
   steps:
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Context
     id: context
     with:
@@ -33,13 +33,13 @@ runs:
       filter: |
         ${{ inputs.context-filter }}
         | . * {"items": ${{ inputs.items }}}
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Steps (JSON)
     id: steps-json
     with:
       input: ${{ inputs.steps }}
       input-format: yaml
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Steps
     id: steps-subs
     with:
@@ -55,7 +55,7 @@ runs:
         | map(.key as $k | $out | . + [($steps | walk(if type == "string" then sub("\\$KEY"; "\($k)") else . end))])
         | flatten
 
-  - uses: envoyproxy/toolshed/actions/using/steps@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/using/steps@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: steps
     with:
       name: ${{ inputs.name }}
diff --git a/actions/gcp/setup/action.yml b/actions/gcp/setup/action.yml
index 9b332e6e7c..8e3cfb50f5 100644
--- a/actions/gcp/setup/action.yml
+++ b/actions/gcp/setup/action.yml
@@ -64,7 +64,7 @@ runs:
     if: ${{ inputs.key }}
     shell: bash
 
-  - uses: envoyproxy/toolshed/actions/github/script/run@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/github/script/run@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: key
     if: ${{ inputs.key }}
     with:
diff --git a/actions/gcs/fuse/action.yml b/actions/gcs/fuse/action.yml
index d85233111a..698e89890f 100644
--- a/actions/gcs/fuse/action.yml
+++ b/actions/gcs/fuse/action.yml
@@ -131,7 +131,7 @@ runs:
           ARCH="arm64"
       fi
       echo "address=${GCSFUSE_DOWNLOAD_ROOT}/${GCSFUSE_VERSION}/gcsfuse_${GCSFUSE_VERSION#v}_${ARCH}.deb" >> $GITHUB_OUTPUT
-  - uses: envoyproxy/toolshed/actions/fetch@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/fetch@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Fetch gcsfuse
     if: ${{ steps.status.outputs.installed != 'true' }}
     with:
@@ -171,7 +171,7 @@ runs:
       echo "key-path=${KEY_PATH}" >> $GITHUB_OUTPUT
       echo "GOOGLE_APPLICATION_CREDENTIALS=${KEY_PATH}" >> $GITHUB_ENV
     shell: bash
-  - uses: envoyproxy/toolshed/actions/github/script/run@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/github/script/run@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Mount GCS bucket
     id: mount
     env:
@@ -232,7 +232,7 @@ runs:
       post: |
         rm -rf ${{ steps.sa.outputs.key-path }}
         ${AS_ROOT} fusermount -u "${{ inputs.mount-point }}" || true
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Parse mount
     with:
       input: ${{ steps.mount.outputs.output-path }}
diff --git a/actions/github/afterall/action.yml b/actions/github/afterall/action.yml
index 017b4ca24d..99d13bfe1d 100644
--- a/actions/github/afterall/action.yml
+++ b/actions/github/afterall/action.yml
@@ -56,7 +56,7 @@ outputs:
 runs:
   using: composite
   steps:
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: workflows
     with:
       options: -sRc
@@ -65,7 +65,7 @@ runs:
         .
         | split("\n")
         | map(select(length > 0))
-  - uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: check-workflows
     env:
       GH_TOKEN: ${{ inputs.token }}
diff --git a/actions/github/artifact/cache/restore/action.yml b/actions/github/artifact/cache/restore/action.yml
index 9842dc7aa0..a357c138df 100644
--- a/actions/github/artifact/cache/restore/action.yml
+++ b/actions/github/artifact/cache/restore/action.yml
@@ -29,7 +29,7 @@ runs:
     if: >-
       ! inputs.id
     id: cache-id
-    uses: envoyproxy/toolshed/actions/github/artifact/cache/id@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/github/artifact/cache/id@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       name: ${{ inputs.name }}
       token: ${{ inputs.token }}
diff --git a/actions/github/checkout/action.yml b/actions/github/checkout/action.yml
index 547d24ef3c..2c51c00e84 100644
--- a/actions/github/checkout/action.yml
+++ b/actions/github/checkout/action.yml
@@ -79,7 +79,7 @@ outputs:
 runs:
   using: composite
   steps:
-  - uses: envoyproxy/toolshed/actions/github/merge-commit@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/github/merge-commit@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: merge-commit
     name: Fetch merge commit hash
     if: ${{ inputs.pr != '' && fromJSON(inputs.fetch-merge-commit) }}
@@ -91,7 +91,7 @@ runs:
   # otherwise the config value is respected.
   - name: Parse YAML config
     id: parsed-config
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input: ${{ inputs.config || '{}' }}
       input-format: yaml
@@ -138,7 +138,7 @@ runs:
   - name: Config
     id: config-token
     if: ${{ inputs.ssh-key == '' }}
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input: ${{ inputs.token || github.token }}
       options: -R
@@ -151,7 +151,7 @@ runs:
         | del(.branch, .["requested-ref"])
   - name: Config
     id: config-ssh
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     if: ${{ inputs.ssh-key != '' }}
     with:
       input: ${{ inputs.ssh-key }}
@@ -190,7 +190,7 @@ runs:
       COMMITTER_EMAIL: ${{ inputs.committer-email }}
     shell: bash
   - id: branch
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input: ${{ fromJSON(steps.parsed-config.outputs.value).branch }}
       input-format: text
diff --git a/actions/github/command/action.yml b/actions/github/command/action.yml
index 2eba5140ad..6db263c73d 100644
--- a/actions/github/command/action.yml
+++ b/actions/github/command/action.yml
@@ -17,7 +17,7 @@ outputs:
 runs:
   using: composite
   steps:
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Parse command from text
     id: command
     with:
diff --git a/actions/github/env/load/action.yml b/actions/github/env/load/action.yml
index 840ca97e4a..def546b61b 100644
--- a/actions/github/env/load/action.yml
+++ b/actions/github/env/load/action.yml
@@ -36,7 +36,7 @@ runs:
   using: composite
   steps:
   # For dispatch events we have to find the request via the Request workflow
-  - uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Find request
     id: find-request
     if: ${{ inputs.head-sha }}
@@ -47,7 +47,7 @@ runs:
         | ("${{ inputs.template-script-current }}" | bash::output)
   - name: Download environment data
     id: download
-    uses: envoyproxy/toolshed/actions/github/artifact/download@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/github/artifact/download@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       name: ${{ inputs.name }}
       path: ${{ runner.temp }}
@@ -55,7 +55,7 @@ runs:
 
   - name: Validate environment source
     if: ${{ github.event_name == 'workflow_run' }}
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input: |
         workflow_event: ${{ toJSON(github.event.workflow_run.event) }}
@@ -79,7 +79,7 @@ runs:
           else
             "✓ Environment source validation passed"
           end
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Load env data
     id: data
     with:
diff --git a/actions/github/env/save/action.yml b/actions/github/env/save/action.yml
index 895abba3ee..02e833edcc 100644
--- a/actions/github/env/save/action.yml
+++ b/actions/github/env/save/action.yml
@@ -20,7 +20,7 @@ runs:
       # Create temporary directory
       OUTPUT_DIR=$(mktemp -d)
       echo "directory=${OUTPUT_DIR}" >> $GITHUB_OUTPUT
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Check proxy data
     id: env
     with:
@@ -32,7 +32,7 @@ runs:
       output-path: ${{ steps.path.outputs.directory }}/${{ inputs.name }}.json
 
   - name: Upload environment data
-    uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+    uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
     with:
       name: ${{ inputs.name }}
       path: ${{ steps.path.outputs.directory }}
diff --git a/actions/github/env/summary/action.yml b/actions/github/env/summary/action.yml
index 86409f3fbd..a60825a955 100644
--- a/actions/github/env/summary/action.yml
+++ b/actions/github/env/summary/action.yml
@@ -61,7 +61,7 @@ outputs:
 runs:
   using: composite
   steps:
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: linked-title
     with:
       input: |
@@ -76,7 +76,7 @@ runs:
       options: -r
       filter: gfm::event_title
 
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: title
     with:
       input: |
@@ -92,7 +92,7 @@ runs:
       filter: gfm::event_title
 
   # This generates a filter from configuration
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Table filter
     id: table-filter
     with:
@@ -103,7 +103,7 @@ runs:
       filter: |
         with_entries({key: .key, value: .value.filter})
         | utils::filters
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Tables
     id: tables
     with:
@@ -121,7 +121,7 @@ runs:
               | select(.value.data | type != "null"))
         | gfm::tables
 
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: output
     with:
       input: ${{ toJSON(inputs) }}
@@ -160,7 +160,7 @@ runs:
         "
         | str::indent($inputs.indent // "0" | fromjson)
 
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     if: ${{ inputs.output-path }}
     with:
       input: ${{ steps.output.outputs.value }}
diff --git a/actions/github/issue/get/action.yml b/actions/github/issue/get/action.yml
index 628c6b2f30..ec051ca359 100644
--- a/actions/github/issue/get/action.yml
+++ b/actions/github/issue/get/action.yml
@@ -60,7 +60,7 @@ runs:
     shell: bash
     env:
       GH_TOKEN: "${{ inputs.GITHUB_TOKEN }}"
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: issue-id
     with:
       input: ${{ steps.issue-query.outputs.result }}
diff --git a/actions/github/merge-commit/action.yml b/actions/github/merge-commit/action.yml
index d8221edc29..e7f75e8d8b 100644
--- a/actions/github/merge-commit/action.yml
+++ b/actions/github/merge-commit/action.yml
@@ -32,14 +32,14 @@ runs:
     shell: bash
     env:
       URL: https://api.github.com/repos/${{ inputs.repository }}/pulls/${{ inputs.pr }}
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: jq
     with:
       input: ${{ steps.fetch.outputs.response }}
       options: -r
       filter: |
         .merge_commit_sha // ""
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     if: ${{ ! steps.jq.outputs.value }}
     with:
       input: ${{ steps.fetch.outputs.response }}
diff --git a/actions/github/pr/action.yml b/actions/github/pr/action.yml
index c7969c39cd..7698ca5b43 100644
--- a/actions/github/pr/action.yml
+++ b/actions/github/pr/action.yml
@@ -59,7 +59,7 @@ runs:
   using: composite
   steps:
   - name: Checkout branch (${{ inputs.branch }})
-    uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     env:
       GH_TOKEN: ${{ inputs.GITHUB_TOKEN }}
       CI_DEBUG: true
@@ -91,7 +91,7 @@ runs:
         | "${{ inputs.template-create-pr }}"
 
   - name: Upload diff
-    uses: envoyproxy/toolshed/actions/upload/diff@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/upload/diff@05dcb996bb8a087a88eb7627e05f99f327f8830b
     if: ${{ inputs.diff-upload }}
     with:
       diff: HEAD^1
diff --git a/actions/github/release/action.yml b/actions/github/release/action.yml
index 89586978ed..22612a8976 100644
--- a/actions/github/release/action.yml
+++ b/actions/github/release/action.yml
@@ -71,7 +71,7 @@ runs:
   steps:
   - name: Check release status
     id: status
-    uses: envoyproxy/toolshed/actions/github/release/status@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/github/release/status@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       name: ${{ inputs.name }}
       repository: ${{ inputs.repository }}
@@ -87,7 +87,7 @@ runs:
       && fromJSON(inputs.artifacts)
       && ! fromJSON(steps.status.outputs.version).is_dev
     name: Download artifacts from workflow runs
-    uses: envoyproxy/toolshed/actions/github/release/artifacts@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/github/release/artifacts@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       filter-artifacts: ${{ inputs.filter-artifacts }}
       gpg-fingerprint: ${{ inputs.gpg-fingerprint }}
@@ -100,7 +100,7 @@ runs:
     if: >-
       fromJSON(steps.status.outputs.continue)
       && ! fromJSON(steps.status.outputs.version).is_dev
-    uses: envoyproxy/toolshed/actions/github/release/publish@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/github/release/publish@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       assets: ${{ fromJSON(inputs.artifacts) && format('{0}/*', inputs.publish-directory) || '' }}
       dry-run: ${{ inputs.dry-run }}
diff --git a/actions/github/release/artifacts/action.yml b/actions/github/release/artifacts/action.yml
index c0ef146850..147791d0d5 100644
--- a/actions/github/release/artifacts/action.yml
+++ b/actions/github/release/artifacts/action.yml
@@ -45,7 +45,7 @@ outputs:
 runs:
   using: composite
   steps:
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Generate download config
     id: download-config
     with:
@@ -64,7 +64,7 @@ runs:
                  name: $name,
                  run_id: $run_ids[.]}})
         | from_entries
-  - uses: envoyproxy/toolshed/actions/foreach@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/foreach@05dcb996bb8a087a88eb7627e05f99f327f8830b
     if: steps.download-config.outputs.value
     with:
       items: ${{ steps.download-config.outputs.value }}
@@ -84,7 +84,7 @@ runs:
   - name: List downloaded artifacts
     id: artifacts
     if: steps.download-config.outputs.value
-    uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       catch-errors: true
       input: |
@@ -112,7 +112,7 @@ runs:
     if: >-
       steps.artifacts.outputs.output != ''
       && steps.artifacts.outputs.output != '{}'
-    uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input: |
         artifacts: ${{ steps.artifacts.outputs.output }}
@@ -129,14 +129,14 @@ runs:
     if: >-
       steps.artifacts.outputs.output != ''
       && steps.artifacts.outputs.output != '{}'
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input: ${{ steps.artifacts.outputs.output }}
   - name: Generate workflow artifacts table
     if: >-
       steps.artifacts.outputs.output != ''
       && steps.artifacts.outputs.output != '{}'
-    uses: envoyproxy/toolshed/actions/json/table@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/json/table@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       title: Artifacts to publish
       append: true
@@ -168,7 +168,7 @@ runs:
       steps.artifacts.outputs.output != '{}'
       && steps.artifacts.outputs.output != ''
       && inputs.gpg-fingerprint != ''
-    uses: envoyproxy/toolshed/actions/gpg/sign@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/gpg/sign@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       debug: ${{ inputs.debug }}
       fingerprint: ${{ inputs.gpg-fingerprint }}
diff --git a/actions/github/release/latest/action.yml b/actions/github/release/latest/action.yml
index f9b4fe1600..927c6dd056 100644
--- a/actions/github/release/latest/action.yml
+++ b/actions/github/release/latest/action.yml
@@ -36,7 +36,7 @@ runs:
   using: composite
   steps:
   - id: latest
-    uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input: |
         repo: ${{ inputs.repository }}
diff --git a/actions/github/release/publish/action.yml b/actions/github/release/publish/action.yml
index 135ffc48b9..3039119ff7 100644
--- a/actions/github/release/publish/action.yml
+++ b/actions/github/release/publish/action.yml
@@ -67,7 +67,7 @@ inputs:
 runs:
   using: composite
   steps:
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     if: >-
       inputs.assets
     id: assets
@@ -79,7 +79,7 @@ runs:
         .
         | split("\n")
         | join(" ")
-  - uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: release
     env:
       GH_TOKEN: ${{ inputs.token }}
@@ -118,7 +118,7 @@ runs:
           && '(dry-run)'
           || ''  }}
     if: fromJSON(inputs.summary)
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input: |
         result: ${{ steps.release.outputs.output || '[]' }}
diff --git a/actions/github/release/shas/action.yml b/actions/github/release/shas/action.yml
index 5ddd97970f..5741c49f99 100644
--- a/actions/github/release/shas/action.yml
+++ b/actions/github/release/shas/action.yml
@@ -24,7 +24,7 @@ runs:
   using: composite
   steps:
   - id: filtered-assets
-    uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input: |
         tag: ${{ inputs.tag }}
diff --git a/actions/github/release/status/action.yml b/actions/github/release/status/action.yml
index 034e665bff..edeef3e584 100644
--- a/actions/github/release/status/action.yml
+++ b/actions/github/release/status/action.yml
@@ -42,20 +42,20 @@ runs:
   steps:
   - name: Check all workflows ran
     id: afterall
-    uses: envoyproxy/toolshed/actions/github/afterall@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/github/afterall@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       sha: ${{ inputs.sha }}
       workflows: ${{ inputs.workflows }}
       repo: ${{ inputs.repository }}
   - name: Version info
     id: version
-    uses: envoyproxy/toolshed/actions/version@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/version@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       version: ${{ inputs.version }}
       version-file: ${{ inputs.version-file }}
   - name: Status summary title
     id: status-summary-title
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       input: |
         name: ${{ inputs.name }}
@@ -72,7 +72,7 @@ runs:
            end) as $release_info
         | "${{ inputs.template-status }}"
   - name: Versions info
-    uses: envoyproxy/toolshed/actions/json/table@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/json/table@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       append: true
       output-path: GITHUB_STEP_SUMMARY
@@ -97,7 +97,7 @@ runs:
             "continue": .continue,
           }
   - name: Generate workflow status table
-    uses: envoyproxy/toolshed/actions/json/table@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/json/table@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       title: Required Workflows Status
       append: true
diff --git a/actions/github/run/action.yml b/actions/github/run/action.yml
index 845bb595ec..469f78a2d6 100644
--- a/actions/github/run/action.yml
+++ b/actions/github/run/action.yml
@@ -112,10 +112,10 @@ runs:
   steps:
   - if: ${{ fromJSON(inputs.diskspace-hack) }}
     name: Free diskspace
-    uses: envoyproxy/toolshed/actions/diskspace@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/diskspace@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       to_remove: ${{ inputs.diskspace-hack-paths }}
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Generate download config
     if: ${{ inputs.downloads }}
     id: download-config
@@ -132,7 +132,7 @@ runs:
              else
                "${{ runner.temp }}/\(.)"
              end)
-  - uses: envoyproxy/toolshed/actions/foreach@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/foreach@05dcb996bb8a087a88eb7627e05f99f327f8830b
     if: ${{ steps.download-config.outputs.value }}
     with:
       items: ${{ steps.download-config.outputs.value }}
@@ -175,7 +175,7 @@ runs:
       OUTPUT_DATA: ${{ inputs.output-path }}
     shell: bash
 
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: entrypoint
     with:
       input: |
@@ -185,7 +185,7 @@ runs:
       output-path: ${{ steps.paths.outputs.entrypoint }}
       print-output: ${{ fromJSON(env.CI_DEBUG || 'false') && true || false }}
 
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: source
     with:
       input: |
@@ -194,27 +194,27 @@ runs:
       options: -Rsr
       output-path: ${{ steps.paths.outputs.source }}
       print-output: ${{ fromJSON(env.CI_DEBUG || 'false') && true || false }}
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Generate run context (steps-pre)
     id: context-steps-pre
     with:
       input: ${{ inputs.steps-pre || '""' }}
       options: -Rs
       input-format: string
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Generate run context (steps-post)
     id: context-steps-post
     with:
       input: ${{ inputs.steps-post || '""' }}
       options: -Rs
       input-format: string
-  - uses: envoyproxy/toolshed/actions/using/steps@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/using/steps@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Pre report
     if: ${{ inputs.report-pre }}
     with:
       steps: ${{ inputs.report-pre }}
       context: ${{ inputs.context }}
-  - uses: envoyproxy/toolshed/actions/using/steps@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/using/steps@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Run pre steps
     if: ${{ inputs.steps-pre }}
     with:
@@ -242,7 +242,7 @@ runs:
     id: command
     shell: bash
 
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     if: ${{ always() }}
     id: started
     with:
@@ -276,21 +276,21 @@ runs:
     env:
       COMMAND: ${{ steps.command.outputs.command }}
       TARGET_PATH: ${{ inputs.working-directory }}
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: cancelled
     if: ${{ cancelled() }}
     with:
       options: -r
       filter: |
         true
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     if: ${{ always() }}
     id: completed
     with:
       options: -r
       filter: now
 
-  - uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     if: ${{ ! (cancelled() || fromJSON(steps.cancelled.outputs.value || 'false')) }}
     with:
       input-format: string-path
@@ -309,7 +309,7 @@ runs:
              error: $error_match,
              fail: $fail_match})
 
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Generate run context
     id: context
     if: ${{ always() }}
@@ -330,7 +330,7 @@ runs:
         | {"run": .,
            "context": ${{ inputs.context || '{}' }}}
 
-  - uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     if: ${{ inputs.container-output && ( ! (cancelled() || fromJSON(steps.cancelled.outputs.value || 'false'))) }}
     with:
       input: |
@@ -350,47 +350,47 @@ runs:
               | "\($dir)/\($v)" as $target
               | "mkdir -p $(dirname \($dir_target))\n\(env.CONTAINER_COMMAND) cp -a \($k) \($target)")
         | join("\n")
-  - uses: envoyproxy/toolshed/actions/using/steps@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/using/steps@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Run post steps
     if: ${{ inputs.steps-post && ! (fromJSON(steps.context.outputs.value).run.cancelled || cancelled()) }}
     with:
       name: ${{ inputs.steps-post-name }}
       steps: ${{ inputs.steps-post }}
       context: ${{ steps.context.outputs.value }}
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: post-failed
     if: ${{ failure() && inputs.upload-name && inputs.upload-path }}
     with:
       input: ${{ steps.context.outputs.value }}
       filter: |
         .run["post-steps-failed"] = true
-  - uses: envoyproxy/toolshed/actions/using/steps@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/using/steps@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Post report
     if: ${{ inputs.report-post && ! (fromJSON(steps.context.outputs.value).run.cancelled || cancelled()) }}
     with:
       steps: ${{ inputs.report-post }}
       context: ${{ steps.context.outputs.value }}
-  - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+  - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
     name: Upload artefacts
     if: ${{ inputs.upload-name && inputs.upload-path && ! (fromJSON(steps.context.outputs.value).run.cancelled || cancelled()) }}
     with:
       name: ${{ inputs.upload-name }}
       path: ${{ startsWith(inputs.upload-path, '/') && inputs.upload-path || format('{0}/{1}', runner.temp, inputs.upload-path) }}
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: upload-failed
     if: ${{ failure() && inputs.upload-name && inputs.upload-path }}
     with:
       input: ${{ steps.post-failed.outputs.value || steps.context.outputs.value }}
       filter: |
         .run["upload-failed"] = true
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: run-cancelled
     if: ${{ cancelled() }}
     with:
       input: ${{ steps.post-failed.outputs.value || steps.context.outputs.value }}
       filter: |
         .run["cancelled"] = true
-  - uses: envoyproxy/toolshed/actions/using/steps@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/using/steps@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Job summary
     if: ${{ always() && inputs.summary-post }}
     with:
@@ -411,7 +411,7 @@ runs:
     id: report
     shell: bash
     if: ${{ always() }}
-  - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+  - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
     name: Upload report
     if: ${{ always() && steps.report.outputs.path }}
     with:
diff --git a/actions/github/should-run/action.yml b/actions/github/should-run/action.yml
index 8880622126..07a3b446d2 100644
--- a/actions/github/should-run/action.yml
+++ b/actions/github/should-run/action.yml
@@ -41,7 +41,7 @@ runs:
     if: inputs.checkout-repo
     with:
       fetch-depth: 0
-  - uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: changed
     with:
       input: |
@@ -59,20 +59,20 @@ runs:
       result-filter: |
         rtrimstr("\n")
         | split("\n")
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: config
     with:
       input: ${{ inputs.config }}
       input-format: yaml
       filter: |
         {"check": .}
-  - uses: envoyproxy/toolshed/actions/torun@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/torun@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: torun
     with:
       event: ${{ inputs.event }}
       paths: ${{ steps.changed.outputs.output }}
       config: ${{ steps.config.outputs.value }}
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: check
     with:
       input: ${{ steps.torun.outputs.runs }}
diff --git a/actions/gpg/action.yml b/actions/gpg/action.yml
index 5679186a70..dfb264d593 100644
--- a/actions/gpg/action.yml
+++ b/actions/gpg/action.yml
@@ -29,14 +29,14 @@ runs:
     id: gpg
     if: >-
       inputs.gpg-key == ''
-    uses: envoyproxy/toolshed/actions/gpg/generate@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/gpg/generate@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       debug: ${{ inputs.debug }}
   - name: Import GPG key
     id: gpg-import
     if: >-
       inputs.gpg-key != ''
-    uses: envoyproxy/toolshed/actions/gpg/import@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/gpg/import@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       key: ${{ inputs.gpg-key }}
       passphrase: ${{ inputs.gpg-password }}
diff --git a/actions/gpg/import/action.yml b/actions/gpg/import/action.yml
index 1bc1f8c12d..83c6952071 100644
--- a/actions/gpg/import/action.yml
+++ b/actions/gpg/import/action.yml
@@ -20,12 +20,12 @@ runs:
   steps:
   - name: Import GPG key
     id: import
-    uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec  # v6
+    uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd  # v7.0.0
     with:
       gpg_private_key: ${{ inputs.key }}
       passphrase: ${{ inputs.passphrase }}
 
-  - uses: envoyproxy/toolshed/actions/github/script/run@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/github/script/run@05dcb996bb8a087a88eb7627e05f99f327f8830b
     if: ${{ inputs.passphrase && inputs.passphrase-path }}
     with:
       run: |
diff --git a/actions/json/table/action.yml b/actions/json/table/action.yml
index fbec271eeb..ce0786aab7 100644
--- a/actions/json/table/action.yml
+++ b/actions/json/table/action.yml
@@ -90,7 +90,7 @@ outputs:
 runs:
   using: composite
   steps:
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     name: Generate table
     id: table
     with:
@@ -109,7 +109,7 @@ runs:
                      ${{ inputs.mutate-cells || '.cell' }};
                      ${{ inputs.sanitize-filter || '.' }})
 
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: summary
     if: ${{ steps.table.outputs.value }}
     with:
diff --git a/actions/oci/collector/action.yml b/actions/oci/collector/action.yml
index f5b5224ad2..29091a6e99 100644
--- a/actions/oci/collector/action.yml
+++ b/actions/oci/collector/action.yml
@@ -51,7 +51,7 @@ runs:
   using: composite
   steps:
   - name: Download OCI artifacts
-    uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+    uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
     with:
       pattern: ${{ inputs.artifacts-pattern }}
       path: ${{ inputs.artifacts-path }}
@@ -80,7 +80,7 @@ runs:
       ls -la ${{ inputs.oci-tmp-path }}
       echo "::endgroup::"
   - name: Buildah operations
-    uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: operations
     with:
       input: |
@@ -117,7 +117,7 @@ runs:
                args: ["push", "--all", $manifest_name, "docker://\($additional_tag)"],
                metadata: {tag: $additional_tag}})]
   - name: Execute buildah operations
-    uses: envoyproxy/toolshed/actions/buildah@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/buildah@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: buildah
     with:
       operations: ${{ steps.operations.outputs.value }}
diff --git a/actions/regctl/install/action.yml b/actions/regctl/install/action.yml
index 27fad61179..9fb219958a 100644
--- a/actions/regctl/install/action.yml
+++ b/actions/regctl/install/action.yml
@@ -19,7 +19,7 @@ runs:
   using: 'composite'
   steps:
   - name: Fetch regctl
-    uses: envoyproxy/toolshed/actions/fetch@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/fetch@05dcb996bb8a087a88eb7627e05f99f327f8830b
     with:
       url: https://github.com/regclient/regclient/releases/download/${{ inputs.version }}/regctl-linux-${{ inputs.arch }}
       path: /tmp/regctl
diff --git a/actions/source/action.yml b/actions/source/action.yml
index f7206503ab..40fa0d5522 100644
--- a/actions/source/action.yml
+++ b/actions/source/action.yml
@@ -46,7 +46,7 @@ outputs:
 runs:
   using: composite
   steps:
-  - uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: create-tarball
     env:
       SOURCE_ACTION_PATH: ${{ github.action_path }}
diff --git a/actions/test-runner/action.yml b/actions/test-runner/action.yml
index b81a3d35a5..850372c043 100644
--- a/actions/test-runner/action.yml
+++ b/actions/test-runner/action.yml
@@ -25,7 +25,7 @@ outputs:
 runs:
   using: composite
   steps:
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: config
     with:
       input: ${{ inputs.config }}
@@ -50,7 +50,7 @@ runs:
       MOCK_LOG="$(mktemp)"
       echo "MOCK_LOG=${MOCK_LOG}" >> "$GITHUB_ENV"
       echo "${ACTION_TEST_PATH}/mocks:$PATH" >> $GITHUB_PATH
-  - uses: envoyproxy/toolshed/actions/using/steps@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/using/steps@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: run
     with:
       name: Run test
diff --git a/actions/upload/diff/action.yml b/actions/upload/diff/action.yml
index 0d53edf5d0..9b0672c253 100644
--- a/actions/upload/diff/action.yml
+++ b/actions/upload/diff/action.yml
@@ -30,7 +30,7 @@ runs:
     name: Show diff
     if: ${{ inputs.show }}
     shell: bash
-  - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+  - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
     with:
       name: ${{ inputs.name }}.diff
       path: ${{ steps.diff.outputs.tmpdir }}/${{ inputs.name }}.diff
diff --git a/actions/using/recurse/action.yml b/actions/using/recurse/action.yml
index c3661377da..16d0e1797c 100644
--- a/actions/using/recurse/action.yml
+++ b/actions/using/recurse/action.yml
@@ -11,7 +11,7 @@ runs:
   steps:
   # .tmp.action/action.yml **must** be hardcoded
 
-  - uses: envoyproxy/toolshed/actions/jq@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+  - uses: envoyproxy/toolshed/actions/jq@05dcb996bb8a087a88eb7627e05f99f327f8830b
     id: yaml
     with:
       input: ${{ inputs.with }}
diff --git a/actions/version/action.yml b/actions/version/action.yml
index 26e8f16eb4..ca4dad8d63 100644
--- a/actions/version/action.yml
+++ b/actions/version/action.yml
@@ -27,7 +27,7 @@ runs:
   using: composite
   steps:
   - id: version
-    uses: envoyproxy/toolshed/actions/bson@8b0c0f9ec9dacf86f092bdfe6c917c48e51286c2
+    uses: envoyproxy/toolshed/actions/bson@05dcb996bb8a087a88eb7627e05f99f327f8830b
     env:
       VERSION: ${{ inputs.version }}
       VERSION_FILE: ${{ inputs.version-file }}