diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b735a46a..6d69b76b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,6 +5,11 @@
 
 version: 2
 updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 6
   - package-ecosystem: cargo
     directory: "/"
     schedule:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 14c97ee0..ba1ffa17 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -42,7 +42,9 @@ jobs:
 
   main:
     needs: set_env
-    uses: solana-program/actions/.github/workflows/main.yml@main
+    # Pinned to a reviewed commit of the upstream reusable workflow; Dependabot
+    # (github-actions ecosystem) proposes bumps.
+    uses: solana-program/actions/.github/workflows/main.yml@2db12a00105e5b260ac43746b69df1658a5dca24 # main 2026-10-02
     with:
       js-packages: ${{ needs.set_env.outputs.JS_PACKAGES }}
       sbpf-program-packages: ${{ needs.set_env.outputs.SBPF_PROGRAM_PACKAGES }}
diff --git a/.github/workflows/publish-js.yml b/.github/workflows/publish-js.yml
index f6775641..76764a94 100644
--- a/.github/workflows/publish-js.yml
+++ b/.github/workflows/publish-js.yml
@@ -55,7 +55,11 @@ jobs:
 
   main:
     needs: set_env
-    uses: solana-program/actions/.github/workflows/publish-js.yml@main
+    # Only publish from the canonical repository on `main`.
+    if: github.repository == 'Sphere-Foundation/stake' && github.ref == 'refs/heads/main'
+    # Pinned to a reviewed commit of the upstream reusable workflow; Dependabot
+    # (github-actions ecosystem) proposes bumps.
+    uses: solana-program/actions/.github/workflows/publish-js.yml@2db12a00105e5b260ac43746b69df1658a5dca24 # main 2026-10-02
     with:
       sbpf-program-packages: "program"
       solana-cli-version: ${{ needs.set_env.outputs.SOLANA_CLI_VERSION }}
diff --git a/.github/workflows/publish-rust.yml b/.github/workflows/publish-rust.yml
index 4ec427be..ae636d62 100644
--- a/.github/workflows/publish-rust.yml
+++ b/.github/workflows/publish-rust.yml
@@ -64,7 +64,11 @@ jobs:
 
   main:
     needs: set_env
-    uses: solana-program/actions/.github/workflows/publish-rust.yml@main
+    # Only publish from the canonical repository on `main`.
+    if: github.repository == 'Sphere-Foundation/stake' && github.ref == 'refs/heads/main'
+    # Pinned to a reviewed commit of the upstream reusable workflow; Dependabot
+    # (github-actions ecosystem) proposes bumps.
+    uses: solana-program/actions/.github/workflows/publish-rust.yml@2db12a00105e5b260ac43746b69df1658a5dca24 # main 2026-10-02
     with:
       sbpf-program-packages: "program"
       solana-cli-version: ${{ needs.set_env.outputs.SOLANA_CLI_VERSION }}
diff --git a/Cargo.lock b/Cargo.lock
index bfe8f242..bb3fecbc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2232,7 +2232,7 @@ dependencies = [
  "tokio",
  "tokio-rustls 0.26.2",
  "tower-service",
- "webpki-roots 1.0.2",
+ "webpki-roots 1.0.10",
 ]
 
 [[package]]
@@ -3934,7 +3934,7 @@ dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
- "webpki-roots 1.0.2",
+ "webpki-roots 1.0.10",
 ]
 
 [[package]]
@@ -4053,7 +4053,7 @@ dependencies = [
  "once_cell",
  "ring",
  "rustls-pki-types",
- "rustls-webpki 0.103.7",
+ "rustls-webpki 0.103.16",
  "subtle",
  "zeroize",
 ]
@@ -4094,10 +4094,10 @@ dependencies = [
  "rustls 0.23.32",
  "rustls-native-certs",
  "rustls-platform-verifier-android",
- "rustls-webpki 0.103.7",
+ "rustls-webpki 0.103.16",
  "security-framework",
  "security-framework-sys",
- "webpki-root-certs",
+ "webpki-root-certs 0.26.11",
  "windows-sys 0.59.0",
 ]
 
@@ -4119,9 +4119,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.7"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e10b3f4191e8a80e6b43eebabfac91e5dcecebb27a71f04e820c47ec41d314bf"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -8495,9 +8495,18 @@ dependencies = [
 
 [[package]]
 name = "webpki-root-certs"
-version = "0.26.8"
+version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09aed61f5e8d2c18344b3faa33a4c837855fe56642757754775548fee21386c4"
+checksum = "75c7f0ef91146ebfb530314f5f1d24528d7f0767efbfd31dce919275413e393e"
+dependencies = [
+ "webpki-root-certs 1.0.10",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -8519,9 +8528,9 @@ checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.2"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e8983c3ab33d6fb807cfcdad2491c4ea8cbc8ed839181c7dfd9c67c83e261b2"
+checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
 dependencies = [
  "rustls-pki-types",
 ]