diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index e2fbf1b9..7517bf27 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -144,7 +144,7 @@ jobs:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Authenticate with GCP
         uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
diff --git a/.github/workflows/call-build-container-single-arch.yaml b/.github/workflows/call-build-container-single-arch.yaml
index 8f72eb80..c5c09618 100644
--- a/.github/workflows/call-build-container-single-arch.yaml
+++ b/.github/workflows/call-build-container-single-arch.yaml
@@ -67,7 +67,7 @@ jobs:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: telemetryforge/agent
           ref: ${{ inputs.ref }}
diff --git a/.github/workflows/call-build-linux-packages.yaml b/.github/workflows/call-build-linux-packages.yaml
index b9bc00b3..9c0d2ef4 100644
--- a/.github/workflows/call-build-linux-packages.yaml
+++ b/.github/workflows/call-build-linux-packages.yaml
@@ -64,7 +64,7 @@ jobs:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
       - name: Checkout ${{ inputs.ref }} code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.ref }}
           repository: telemetryforge/agent
diff --git a/.github/workflows/call-build-macos-packages.yaml b/.github/workflows/call-build-macos-packages.yaml
index c3ae794b..99554710 100644
--- a/.github/workflows/call-build-macos-packages.yaml
+++ b/.github/workflows/call-build-macos-packages.yaml
@@ -48,7 +48,7 @@ jobs:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
       - name: Checkout ${{ inputs.ref }} code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.ref }}
           repository: telemetryforge/agent
diff --git a/.github/workflows/call-build-windows-packages.yaml b/.github/workflows/call-build-windows-packages.yaml
index 1e966e97..afc1d66d 100644
--- a/.github/workflows/call-build-windows-packages.yaml
+++ b/.github/workflows/call-build-windows-packages.yaml
@@ -52,7 +52,7 @@ jobs:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
       - name: Checkout ${{ inputs.ref }} code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.ref }}
           repository: telemetryforge/agent
diff --git a/.github/workflows/call-get-metadata.yaml b/.github/workflows/call-get-metadata.yaml
index 5b6a04f2..75fca019 100644
--- a/.github/workflows/call-get-metadata.yaml
+++ b/.github/workflows/call-get-metadata.yaml
@@ -71,7 +71,7 @@ jobs:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: telemetryforge/agent
           ref: ${{ inputs.ref }}
diff --git a/.github/workflows/call-test-containers-k8s.yaml b/.github/workflows/call-test-containers-k8s.yaml
index 1043d3c1..c07f3d70 100644
--- a/.github/workflows/call-test-containers-k8s.yaml
+++ b/.github/workflows/call-test-containers-k8s.yaml
@@ -46,7 +46,7 @@ jobs:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: telemetryforge/agent
           ref: ${{ inputs.ref || github.ref }}
diff --git a/.github/workflows/call-test-containers.yaml b/.github/workflows/call-test-containers.yaml
index ef624471..05e996ad 100644
--- a/.github/workflows/call-test-containers.yaml
+++ b/.github/workflows/call-test-containers.yaml
@@ -39,7 +39,7 @@ jobs:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: telemetryforge/agent
           ref: ${{ inputs.ref || github.ref }}
@@ -70,7 +70,7 @@ jobs:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: telemetryforge/agent
           ref: ${{ inputs.ref || github.ref }}
@@ -132,7 +132,7 @@ jobs:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: telemetryforge/agent
           ref: ${{ inputs.ref || github.ref }}
diff --git a/.github/workflows/call-test-packages.yaml b/.github/workflows/call-test-packages.yaml
index 9cfbc24b..0c2a7ba0 100644
--- a/.github/workflows/call-test-packages.yaml
+++ b/.github/workflows/call-test-packages.yaml
@@ -125,7 +125,7 @@ jobs:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: telemetryforge/agent
           ref: ${{ inputs.ref }}
@@ -203,7 +203,7 @@ jobs:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: telemetryforge/agent
           ref: ${{ inputs.ref }}
diff --git a/.github/workflows/cron-auto-release.yaml b/.github/workflows/cron-auto-release.yaml
index f9612c00..32b7d4cd 100644
--- a/.github/workflows/cron-auto-release.yaml
+++ b/.github/workflows/cron-auto-release.yaml
@@ -47,7 +47,7 @@ jobs:
         with:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: 25.10 run
         if: github.event_name == 'schedule' && github.event.schedule=='0 14 1 * *'
@@ -138,7 +138,7 @@ jobs:
           secrets: |-
             github-pat:projects/626836145334/secrets/GITHUB_CI_PAT
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.find-last-good.outputs.sha }}
           # The tag must be pushed using a PAT to ensure workflows then run.
diff --git a/.github/workflows/cron-lts-update-branches.yaml b/.github/workflows/cron-lts-update-branches.yaml
index d713608d..47e989a2 100644
--- a/.github/workflows/cron-lts-update-branches.yaml
+++ b/.github/workflows/cron-lts-update-branches.yaml
@@ -36,7 +36,7 @@ jobs:
         with:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ matrix.branch }}
 
diff --git a/.github/workflows/cron-update-docs-workflow-pin.yaml b/.github/workflows/cron-update-docs-workflow-pin.yaml
index 272c007e..e2caec3c 100644
--- a/.github/workflows/cron-update-docs-workflow-pin.yaml
+++ b/.github/workflows/cron-update-docs-workflow-pin.yaml
@@ -31,7 +31,7 @@ jobs:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve latest documentation main SHA and update release workflow pin
         id: update-pin
diff --git a/.github/workflows/pr-dependency-review.yml b/.github/workflows/pr-dependency-review.yml
index 37892713..a642ee22 100644
--- a/.github/workflows/pr-dependency-review.yml
+++ b/.github/workflows/pr-dependency-review.yml
@@ -30,7 +30,7 @@ jobs:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
       - name: "Checkout Repository"
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: "Dependency Review"
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:
diff --git a/.github/workflows/pr-lint-packages.yaml b/.github/workflows/pr-lint-packages.yaml
index 6ca95b85..1f4154e4 100644
--- a/.github/workflows/pr-lint-packages.yaml
+++ b/.github/workflows/pr-lint-packages.yaml
@@ -39,7 +39,7 @@ jobs:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
       - name: Checkout for config file
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download package
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
diff --git a/.github/workflows/pr-lint.yaml b/.github/workflows/pr-lint.yaml
index fa8cbafc..1edcf1ce 100644
--- a/.github/workflows/pr-lint.yaml
+++ b/.github/workflows/pr-lint.yaml
@@ -27,7 +27,7 @@ jobs:
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
         # Ignores do not work: https://github.com/reviewdog/action-hadolint/issues/35 is resolved
@@ -45,7 +45,7 @@ jobs:
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1.32.0
@@ -68,7 +68,7 @@ jobs:
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - run: |
@@ -85,7 +85,7 @@ jobs:
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - run: ./scripts/format-yaml-files.sh
@@ -148,7 +148,7 @@ jobs:
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0
@@ -170,12 +170,12 @@ jobs:
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
         with:
           # We only want to scan our workflows, no other included source
           inputs: |
diff --git a/.github/workflows/release-build.yaml b/.github/workflows/release-build.yaml
index 1a670daf..487efeb5 100644
--- a/.github/workflows/release-build.yaml
+++ b/.github/workflows/release-build.yaml
@@ -125,7 +125,7 @@ jobs:
         with:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         # We need full history to be able to detect branch ancestry
         with:
           fetch-depth: 0
@@ -259,7 +259,7 @@ jobs:
 
       - name: Create release
         # This may fail for workflow_dispatch if the release already exists
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           append_body: true
           token: ${{ steps.get-secrets-release.outputs.github-pat }}
diff --git a/.github/workflows/release-update-version.yaml b/.github/workflows/release-update-version.yaml
index a217b332..bd18948a 100644
--- a/.github/workflows/release-update-version.yaml
+++ b/.github/workflows/release-update-version.yaml
@@ -41,7 +41,7 @@ jobs:
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # Fetch all history including tags
 
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 6376b7d8..90a33c38 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -42,7 +42,7 @@ jobs:
           egress-policy: ${{ vars.STEP_SECURITY_EGRESS_POLICY || 'audit' }}
 
       - name: "Checkout code"
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -66,6 +66,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/unit-tests.yaml b/.github/workflows/unit-tests.yaml
index 9b6de561..0c9f2998 100644
--- a/.github/workflows/unit-tests.yaml
+++ b/.github/workflows/unit-tests.yaml
@@ -56,7 +56,7 @@ jobs:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup environment
         # Check the source/packaging/docker/ubuntu/Dockerfile for the dependencies we need