diff --git a/.github/workflows/agent-ci.yml b/.github/workflows/agent-ci.yml
index d36bd74..f430b52 100644
--- a/.github/workflows/agent-ci.yml
+++ b/.github/workflows/agent-ci.yml
@@ -18,6 +18,6 @@ on:
 jobs:
   agent-ci:
     # Pinned to an immutable core commit SHA, not @main (see ci.yml for why).
-    uses: codefly-dev/core/.github/workflows/agent-ci.yml@ce29e08b80e0a328acb61138faf57a4c58b5049f # v0.19.5
+    uses: codefly-dev/core/.github/workflows/agent-ci.yml@a06da5fccc7bc3fbf0e399d80eb41be00f2340fb # v0.19.8
     with:
       codefly-cli-version: "0.1.188"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4e53181..478ee9d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ jobs:
     # Pinned to an immutable core commit SHA, not @main: a mutable ref lets an
     # upstream change alter this repo's gate — which runs with this repo's token
     # — with no commit here. Bump deliberately alongside the go.mod core version.
-    uses: codefly-dev/core/.github/workflows/go-service-ci.yml@ce29e08b80e0a328acb61138faf57a4c58b5049f # v0.19.5
+    uses: codefly-dev/core/.github/workflows/go-service-ci.yml@a06da5fccc7bc3fbf0e399d80eb41be00f2340fb # v0.19.8
 
   # The shared go-service-ci runs `go test` without the race detector; this
   # repo's events hub, Watch streams and readiness monitor are concurrent, so
diff --git a/.github/workflows/publish-gateway-image.yml b/.github/workflows/publish-gateway-image.yml
index 9443b07..7ffa8a0 100644
--- a/.github/workflows/publish-gateway-image.yml
+++ b/.github/workflows/publish-gateway-image.yml
@@ -59,7 +59,7 @@ jobs:
       # it is this repository's shipped-platform declaration, asserted against
       # internal/imageevidence.Platforms by TestShippedPlatformsMatchTheReleasePipeline,
       # so evidence can never cover fewer platforms than the release ships.
-      - uses: codefly-dev/core/.github/actions/publish-service-image@ce29e08b80e0a328acb61138faf57a4c58b5049f # v0.19.5
+      - uses: codefly-dev/core/.github/actions/publish-service-image@a06da5fccc7bc3fbf0e399d80eb41be00f2340fb # v0.19.8
         id: publish
         with:
           version: ${{ inputs.version }}
diff --git a/.github/workflows/publish-minio-image.yml b/.github/workflows/publish-minio-image.yml
index 9d0371c..b5d8d1e 100644
--- a/.github/workflows/publish-minio-image.yml
+++ b/.github/workflows/publish-minio-image.yml
@@ -50,7 +50,7 @@ jobs:
           grep -qx "ARG MINIO_RELEASE_TAG=${MINIO_RELEASE_TAG}" images/minio/Dockerfile
           grep -qx "ARG MINIO_COMMIT=${MINIO_COMMIT}" images/minio/Dockerfile
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 299d7fd..6ed66b5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,7 +45,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -143,5 +143,5 @@ jobs:
     # carries secrets: inherit, so a mutable ref would hand an upstream change
     # this repo's GH_PAT with no commit here — the risk ci.yml pins against,
     # on the one call that actually inherits the token. Bump deliberately.
-    uses: codefly-dev/core/.github/workflows/go-service-release.yml@ce29e08b80e0a328acb61138faf57a4c58b5049f # v0.19.5
+    uses: codefly-dev/core/.github/workflows/go-service-release.yml@a06da5fccc7bc3fbf0e399d80eb41be00f2340fb # v0.19.8
     secrets: inherit