diff --git a/.github/workflows/agda-meta-checker.yml b/.github/workflows/agda-meta-checker.yml
index d835b433..c907d1b0 100644
--- a/.github/workflows/agda-meta-checker.yml
+++ b/.github/workflows/agda-meta-checker.yml
@@ -62,7 +62,7 @@ jobs:
 
       - name: Setup Haskell
         if: steps.detect.outputs.relevant == 'true'
-        uses: haskell-actions/setup@v2.11.0
+        uses: haskell-actions/setup@v2.12.0
         with:
           ghc-version: '9.6'
           cabal-version: '3.10'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 169aa4b7..9aec8ef4 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -42,12 +42,12 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.3
+        uses: github/codeql-action/init@v4.37.6
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.3
+        uses: github/codeql-action/analyze@v4.37.6
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/mvp-smoke.yml b/.github/workflows/mvp-smoke.yml
index 92fd1d66..2476c5f2 100644
--- a/.github/workflows/mvp-smoke.yml
+++ b/.github/workflows/mvp-smoke.yml
@@ -40,7 +40,7 @@ jobs:
         uses: Swatinem/rust-cache@v2.9.1
 
       - name: Install just
-        uses: taiki-e/install-action@v2.85.3
+        uses: taiki-e/install-action@v2.85.8
         with:
           # Governance R1 requires versioned family-tool pins
           # (just|must|trust|adjust|bust|dust|intend); bare `tool: just`
diff --git a/.github/workflows/s4-loop.yml b/.github/workflows/s4-loop.yml
index 4537b41e..eac9fc45 100644
--- a/.github/workflows/s4-loop.yml
+++ b/.github/workflows/s4-loop.yml
@@ -41,7 +41,7 @@ jobs:
       - name: Cache Cargo
         uses: Swatinem/rust-cache@v2.9.1
       - name: Install just
-        uses: taiki-e/install-action@v2.85.3
+        uses: taiki-e/install-action@v2.85.8
         with:
           tool: just@1.51.0
       - name: Install system dependencies