diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 88a002e2488..851ced30157 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -34,11 +34,12 @@ jobs:
       - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           version: 2026.9.14
-      - uses: SonarSource/ci-github-actions/build-maven@v2
+      - uses: SonarSource/ci-github-actions/build-maven@c3a85ac3a2f67f86966e2fb1fdf9a7c1bdc997dc # 2.2.0
         id: build-maven
         env:
           MAVEN_OPTS: "-Xmx8g"
         with:
+          repox-url: https://repox-internal.dev.sonar.build
           deploy-pull-request: true
           sonar-platform: none # Prevent analysis
           # Override artifactory roles for public repo using private access
@@ -91,8 +92,9 @@ jobs:
         with:
           namespace: ruling-qa-${{ matrix.item.runner }}-${{ matrix.item.profile }}-${{ matrix.item.sq_version }}
       - name: Configure Maven
-        uses: SonarSource/ci-github-actions/config-maven@v2
+        uses: SonarSource/ci-github-actions/config-maven@c3a85ac3a2f67f86966e2fb1fdf9a7c1bdc997dc # 2.2.0
         with:
+          repox-url: https://repox-internal.dev.sonar.build
           artifactory-reader-role: private-reader
           use-develocity: ${{ env.USE_DEVELOCITY }}
           develocity-url: ${{ env.DEVELOCITY_URL }}
@@ -210,8 +212,9 @@ jobs:
         with:
           namespace: plugin-qa-${{ matrix.sq_version }}
       - name: Configure Maven
-        uses: SonarSource/ci-github-actions/config-maven@v2
+        uses: SonarSource/ci-github-actions/config-maven@c3a85ac3a2f67f86966e2fb1fdf9a7c1bdc997dc # 2.2.0
         with:
+          repox-url: https://repox-internal.dev.sonar.build
           artifactory-reader-role: private-reader
           use-develocity: ${{ env.USE_DEVELOCITY }}
           develocity-url: ${{ env.DEVELOCITY_URL }}
@@ -258,8 +261,9 @@ jobs:
       - uses: ./.github/actions/maven-cache
         with:
           namespace: sanity
-      - uses: SonarSource/ci-github-actions/config-maven@v2
+      - uses: SonarSource/ci-github-actions/config-maven@c3a85ac3a2f67f86966e2fb1fdf9a7c1bdc997dc # 2.2.0
         with:
+          repox-url: https://repox-internal.dev.sonar.build
           artifactory-reader-role: private-reader
           use-develocity: ${{ env.USE_DEVELOCITY }}
           develocity-url: ${{ env.DEVELOCITY_URL }}
@@ -301,8 +305,9 @@ jobs:
           secrets: |
             development/kv/data/next url | SONAR_HOST_URL;
             development/kv/data/next token | SONAR_TOKEN;
-      - uses: SonarSource/ci-github-actions/build-maven@v2
+      - uses: SonarSource/ci-github-actions/build-maven@c3a85ac3a2f67f86966e2fb1fdf9a7c1bdc997dc # 2.2.0
         with:
+          repox-url: https://repox-internal.dev.sonar.build
           deploy: false
           artifactory-reader-role: private-reader    # Override default public-reader
           artifactory-deployer-role: qa-deployer     # Override default public-deployer
@@ -340,8 +345,9 @@ jobs:
       - uses: ./.github/actions/maven-cache
         with:
           namespace: custom-rules-license-check
-      - uses: SonarSource/ci-github-actions/config-maven@v2
+      - uses: SonarSource/ci-github-actions/config-maven@c3a85ac3a2f67f86966e2fb1fdf9a7c1bdc997dc # 2.2.0
         with:
+          repox-url: https://repox-internal.dev.sonar.build
           artifactory-reader-role: private-reader
           use-develocity: ${{ env.USE_DEVELOCITY }}
           develocity-url: ${{ env.DEVELOCITY_URL }}
@@ -384,8 +390,9 @@ jobs:
         with:
           namespace: qa-os-win
       - name: Configure Maven
-        uses: SonarSource/ci-github-actions/config-maven@v2
+        uses: SonarSource/ci-github-actions/config-maven@c3a85ac3a2f67f86966e2fb1fdf9a7c1bdc997dc # 2.2.0
         with:
+          repox-url: https://repox-internal.dev.sonar.build
           artifactory-reader-role: private-reader
           use-develocity: ${{ env.USE_DEVELOCITY }}
           develocity-url: ${{ env.DEVELOCITY_URL }}
@@ -414,7 +421,7 @@ jobs:
     env:
       BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
     steps:
-      - uses: SonarSource/ci-github-actions/promote@v2
+      - uses: SonarSource/ci-github-actions/promote@c3a85ac3a2f67f86966e2fb1fdf9a7c1bdc997dc # 2.2.0
         with:
           promote-pull-request: true
 
diff --git a/.github/workflows/unified-dogfooding.yml b/.github/workflows/unified-dogfooding.yml
index 108b54a130b..c07993c2f1f 100644
--- a/.github/workflows/unified-dogfooding.yml
+++ b/.github/workflows/unified-dogfooding.yml
@@ -16,11 +16,12 @@ jobs:
       - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           version: 2026.9.14
-      - uses: SonarSource/ci-github-actions/build-maven@v2
+      - uses: SonarSource/ci-github-actions/build-maven@c3a85ac3a2f67f86966e2fb1fdf9a7c1bdc997dc # 2.2.0
         env:
           MAVEN_OPTS: "-Xmx8g"
           JAVA_TOOL_OPTIONS: ""
         with:
+          repox-url: https://repox-internal.dev.sonar.build
           run-shadow-scans: true
           artifactory-reader-role: private-reader
           artifactory-deployer-role: qa-deployer
diff --git a/pom.xml b/pom.xml
index 5d2ed8261e5..e5da5dae7c9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -96,7 +96,7 @@
     <sonar.sca.exclusions>its/**,java-checks-test-sources/**</sonar.sca.exclusions>
     <analyzer.commons.version>2.33.0.5369</analyzer.commons.version>
     <orchestrator.version>6.4.3.4676</orchestrator.version>
-    <sonar.integration.tester.version>1.2.0.1354</sonar.integration.tester.version>
+    <sonar.integration.tester.version>1.3.0.1396</sonar.integration.tester.version>
     <sslr.version>1.26.0.4194</sslr.version>
     <argLine>-Xmx512m</argLine>
     <gitRepositoryName>sonar-java</gitRepositoryName>