diff --git a/.github/workflows/chapel-ci.yml b/.github/workflows/chapel-ci.yml
index acc67b1c..c23c794f 100644
--- a/.github/workflows/chapel-ci.yml
+++ b/.github/workflows/chapel-ci.yml
@@ -153,7 +153,7 @@ jobs:
           toolchain: stable
 
       - name: Rust cache
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@v2.9.2
 
       - name: Download FFI library
         uses: actions/download-artifact@v8.0.1
@@ -207,7 +207,7 @@ jobs:
           toolchain: stable
 
       - name: Rust cache
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@v2.9.2
 
       - name: Download real Chapel library
         uses: actions/download-artifact@v8.0.1
diff --git a/.github/workflows/formal-verification.yml b/.github/workflows/formal-verification.yml
index 707454a6..b453b263 100644
--- a/.github/workflows/formal-verification.yml
+++ b/.github/workflows/formal-verification.yml
@@ -56,7 +56,7 @@ jobs:
           toolchain: stable
 
       - name: Cache Rust build artefacts
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@v2.9.2
         with:
           workspaces: ". -> target"
 
diff --git a/.github/workflows/ghcr-publish.yml b/.github/workflows/ghcr-publish.yml
index 7b08de67..6f6b8256 100644
--- a/.github/workflows/ghcr-publish.yml
+++ b/.github/workflows/ghcr-publish.yml
@@ -89,14 +89,14 @@ jobs:
       #   gh attest verify oci://ghcr.io/${{ github.repository }}:<tag> \
       #     --repo ${{ github.repository }}
       - name: Attest container provenance (minimal image)
-        uses: actions/attest-build-provenance@v4.1.1
+        uses: actions/attest-build-provenance@v4.2.2
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.min_digest }}
           push-to-registry: true
 
       - name: Attest container provenance (full image)
-        uses: actions/attest-build-provenance@v4.1.1
+        uses: actions/attest-build-provenance@v4.2.2
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.full_digest }}
diff --git a/.github/workflows/live-provers.yml b/.github/workflows/live-provers.yml
index 6b2e93c8..e599633d 100644
--- a/.github/workflows/live-provers.yml
+++ b/.github/workflows/live-provers.yml
@@ -81,7 +81,7 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
 
       - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@v2.9.2
 
       - name: Provision prover (${{ matrix.backend }})
         run: |
@@ -173,7 +173,7 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
       - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@v2.9.2
       - name: Provision ${{ matrix.backend }} (best-effort via apt / upstream release)
         continue-on-error: true
         run: |
@@ -321,7 +321,7 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
       - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@v2.9.2
       - name: Provision ${{ matrix.backend }} (best-effort)
         continue-on-error: true
         run: |
@@ -449,7 +449,7 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
       - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@v2.9.2
       - name: Provision ${{ matrix.backend }} (best-effort, CUDA/OpenCL required)
         continue-on-error: true
         run: |
diff --git a/.github/workflows/mvp-smoke.yml b/.github/workflows/mvp-smoke.yml
index 2476c5f2..fbec1771 100644
--- a/.github/workflows/mvp-smoke.yml
+++ b/.github/workflows/mvp-smoke.yml
@@ -37,10 +37,10 @@ jobs:
           toolchain: stable
 
       - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@v2.9.2
 
       - name: Install just
-        uses: taiki-e/install-action@v2.85.8
+        uses: taiki-e/install-action@v2.85.11
         with:
           # Governance R1 requires versioned family-tool pins
           # (just|must|trust|adjust|bust|dust|intend); bare `tool: just`
diff --git a/.github/workflows/s4-loop.yml b/.github/workflows/s4-loop.yml
index eac9fc45..76578448 100644
--- a/.github/workflows/s4-loop.yml
+++ b/.github/workflows/s4-loop.yml
@@ -39,9 +39,9 @@ jobs:
         with:
           toolchain: stable
       - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@v2.9.2
       - name: Install just
-        uses: taiki-e/install-action@v2.85.8
+        uses: taiki-e/install-action@v2.85.11
         with:
           tool: just@1.51.0
       - name: Install system dependencies
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 58d56448..1b46b661 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -21,6 +21,6 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@774dceb6373d798ad4d96a9e40c3993942c2836e # main 2026-07-07 (skip dispatch without VERISIMDB_PAT)
+    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@887ca863ab0837be4d0002d33389862be8c7bee5 # main 2026-07-07 (skip dispatch without VERISIMDB_PAT)
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}
diff --git a/.github/workflows/server-boot-gate.yml b/.github/workflows/server-boot-gate.yml
index f9f0333d..9d900c78 100644
--- a/.github/workflows/server-boot-gate.yml
+++ b/.github/workflows/server-boot-gate.yml
@@ -31,7 +31,7 @@ jobs:
         with:
           toolchain: stable
       - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@v2.9.2
       - name: Install system dependencies
         run: sudo apt-get install -y libssl-dev pkg-config
       - name: Build echidna binary