diff --git a/.github/workflows/auto-bot-land.yml b/.github/workflows/auto-bot-land.yml
index 6050d193c..10576c2ec 100644
--- a/.github/workflows/auto-bot-land.yml
+++ b/.github/workflows/auto-bot-land.yml
@@ -290,7 +290,7 @@ jobs:
         if: steps.target.outputs.num != ''
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         if: steps.target.outputs.num != ''
       # THE LANE NEEDS THE ENGINE NOW, AND NOTHING WAS PROVIDING IT (CLOUD-1143's
       # consequence). `checks-green` was retired onto the engine, so `mise.toml`'s
diff --git a/.github/workflows/auto-release-land.yml b/.github/workflows/auto-release-land.yml
index 00cd27f25..bae325a65 100644
--- a/.github/workflows/auto-release-land.yml
+++ b/.github/workflows/auto-release-land.yml
@@ -209,7 +209,7 @@ jobs:
         if: steps.target.outputs.num != ''
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         if: steps.target.outputs.num != ''
       # THE LANE NEEDS THE ENGINE NOW, AND NOTHING WAS PROVIDING IT (CLOUD-1143's
       # consequence). `checks-green` was retired onto the engine, so `mise.toml`'s
diff --git a/.github/workflows/branch-hygiene.yml b/.github/workflows/branch-hygiene.yml
index fe360ebd2..7b95f93ef 100644
--- a/.github/workflows/branch-hygiene.yml
+++ b/.github/workflows/branch-hygiene.yml
@@ -43,7 +43,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # `gh` for both readings, `jq` for the GraphQL projection. Narrow, for
           # the reason ci.yml states: the whole toolchain is ~10s a job that
diff --git a/.github/workflows/ci-drift.yml b/.github/workflows/ci-drift.yml
index 9712429cf..8dd14ac0a 100644
--- a/.github/workflows/ci-drift.yml
+++ b/.github/workflows/ci-drift.yml
@@ -46,7 +46,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       # THE FETCH, one step before the gate. It lives here rather than in a
       # `mise-tasks/` program because a credentialed read is the one thing the
       # engine may not do (house-style §5), and this is where the job token
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d300d70bf..137ed7952 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -201,7 +201,7 @@ jobs:
           if [ "$BASE_REF" != main ]; then
             git fetch origin "$BASE_REF:refs/remotes/origin/$BASE_REF"
           fi
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # Install only what this job's gates actually invoke, not the whole
           # 18-tool dev set. Every job used to install everything, and `zig`
@@ -512,7 +512,7 @@ jobs:
           fetch-depth: 0
       - name: Fetch the comparison base refs
         run: git fetch origin main:refs/remotes/origin/main
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # One line, for the reason the `ci` job's list states: `ci-tools-check`
           # parses these as a scalar and several names begin with `aqua:`, which
@@ -628,7 +628,7 @@ jobs:
           # merge base, and an unresolvable base is exit 2 by design rather than
           # a pass, so this would fail loudly rather than measure nothing.
           fetch-depth: 0
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # rust builds the two binaries under measurement, hyperfine samples
           # them, jq reads the ratio out. See the ci job for why these lists are
diff --git a/.github/workflows/commit-lint.yml b/.github/workflows/commit-lint.yml
index 89f1de8d8..58474306e 100644
--- a/.github/workflows/commit-lint.yml
+++ b/.github/workflows/commit-lint.yml
@@ -93,7 +93,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # `rust`, and nothing else. `commit-lint` depends on `commit-check` and
           # `commit-attribution`, both of which are `cargo run --quiet -p batten`,
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 601267b74..f91b2a3a8 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -55,7 +55,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # cargo-llvm-cov drives cargo; rust supplies the compiler and the
           # rustup that fetches llvm-tools-preview. Nothing else is invoked.
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index c4dd70382..1eb796138 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -65,7 +65,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # `rust` alone: it supplies cargo and the rustup that `mise run fuzz`
           # uses to fetch the nightly libFuzzer's `-Z sanitizer` requires, and
diff --git a/.github/workflows/hook-latency-drift.yml b/.github/workflows/hook-latency-drift.yml
index d64da13a0..7e60ebaaf 100644
--- a/.github/workflows/hook-latency-drift.yml
+++ b/.github/workflows/hook-latency-drift.yml
@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       - name: Report a fast tier that no longer matches its budget
         shell: bash
         env:
diff --git a/.github/workflows/land-divergence.yml b/.github/workflows/land-divergence.yml
index 9e636d81b..617a75459 100644
--- a/.github/workflows/land-divergence.yml
+++ b/.github/workflows/land-divergence.yml
@@ -55,7 +55,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       # Measure to a FILE, then read it back — never `measure | assert`. A
       # pipeline hands the step's exit status to its last stage, so a measurement
       # that died would be judged as a clean empty window rather than reported
diff --git a/.github/workflows/linear-release-backfill.yml b/.github/workflows/linear-release-backfill.yml
index 13fc394f9..9097e8484 100644
--- a/.github/workflows/linear-release-backfill.yml
+++ b/.github/workflows/linear-release-backfill.yml
@@ -149,14 +149,14 @@ jobs:
       # `github_token` is deliberately not passed — the action defaults it to
       # `${{ github.token }}`, which the job's `contents: read` covers.
       - name: Record the release in Linear
-        uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
+        uses: linear/linear-release-action@3f31fcf14c110cc53579fcc3575a26d469c413b4 # v0.17.1
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: sync
           version: ${{ inputs.tag }}
           base_ref: ${{ steps.base.outputs.ref }}
       - name: Complete the Linear release
-        uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
+        uses: linear/linear-release-action@3f31fcf14c110cc53579fcc3575a26d469c413b4 # v0.17.1
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: complete
diff --git a/.github/workflows/lock-currency.yml b/.github/workflows/lock-currency.yml
index 5dbe60e8c..02efa4b98 100644
--- a/.github/workflows/lock-currency.yml
+++ b/.github/workflows/lock-currency.yml
@@ -45,7 +45,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       # The lockfile rewrite this performs is fine here and only here: the
       # checkout is disposable, and no commit is being judged by it.
       - run: mise run lock-check
diff --git a/.github/workflows/mutant.yml b/.github/workflows/mutant.yml
index 218fc6b41..de0fbaa63 100644
--- a/.github/workflows/mutant.yml
+++ b/.github/workflows/mutant.yml
@@ -95,7 +95,7 @@ jobs:
           # committed bytes, so it needs the work tree rather than history — and
           # it writes nothing, so no credential is persisted.
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       # THE PAIR IS THE VERDICT, never either alone. `mutant` asks whether each
       # declared mutation is caught; `mutant-census` asks whether every gate in
       # the tree is declared or carries a filed exemption. A change that dropped a
diff --git a/.github/workflows/nonverdict-rate.yml b/.github/workflows/nonverdict-rate.yml
index 7eab4a100..8b4849173 100644
--- a/.github/workflows/nonverdict-rate.yml
+++ b/.github/workflows/nonverdict-rate.yml
@@ -60,7 +60,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       # Measure to a FILE, then read it back — never `scan | assert`. A pipeline
       # hands the step's exit status to its last stage, so a scan that died would
       # be judged as an empty window rather than reported (perf.yml:84-92).
diff --git a/.github/workflows/perf.yml b/.github/workflows/perf.yml
index 87a3f1bce..431d2fbf0 100644
--- a/.github/workflows/perf.yml
+++ b/.github/workflows/perf.yml
@@ -93,7 +93,7 @@ jobs:
       # and a missing ref is the empty series rather than a failure.
       - name: Fetch the existing series
         run: git fetch origin "refs/notes/perf:refs/notes/perf" || true
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # rust builds the binary under measurement, hyperfine samples it, jq
           # reads the sampler's JSON back out. Nothing else is invoked.
diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml
index 00aec8508..6792da39f 100644
--- a/.github/workflows/release-artifacts.yml
+++ b/.github/workflows/release-artifacts.yml
@@ -125,7 +125,7 @@ jobs:
       # flags cache-poisoning as high severity precisely on artifact-publishing
       # workflows: a poisoned cache entry would end up inside a signed binary,
       # and the attestation would faithfully attest to the compromised build.
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           cache: false
       - name: Install cross
@@ -263,7 +263,7 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           cache: false
       - name: Derive both schemas from the tagged config types
@@ -337,7 +337,7 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           cache: false
       # `checksums` emits a sums= KEY=VALUE line, so the asset path is decided in
diff --git a/.github/workflows/release-assets.yml b/.github/workflows/release-assets.yml
index 3b35b7c86..4cc29f367 100644
--- a/.github/workflows/release-assets.yml
+++ b/.github/workflows/release-assets.yml
@@ -51,7 +51,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       # TAG goes through env, never interpolated into the run block: a `${{ }}`
       # expansion is textual substitution into the shell script, so a tag naming
       # shell metacharacters would execute. Same posture as every other run block
diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index a7a939e46..419676641 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -152,7 +152,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # Exactly what the `ci` job needs to compile the workspace, minus the
           # tools only its assertions use: the cache being filled is a cargo
@@ -186,7 +186,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # Exactly what the `windows` job installs, minus the tools only its
           # assertions need: the cache being filled is a cargo target dir.
@@ -249,7 +249,7 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.RELEASE_PLZ_TOKEN || secrets.GITHUB_TOKEN }}
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       # release-plz clones the repo into a temp dir; `git fetch origin main` there
       # has no credentials (actions/checkout's auth lives only on the main clone),
       # so it cannot rebase the release branch onto main — the PR is then re-opened
@@ -339,14 +339,14 @@ jobs:
       # silently shipping an untracked release.
       - name: Record the release in Linear
         if: steps.release-tag.outputs.tag != ''
-        uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
+        uses: linear/linear-release-action@3f31fcf14c110cc53579fcc3575a26d469c413b4 # v0.17.1
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: sync
           version: ${{ steps.release-tag.outputs.tag }}
       - name: Complete the Linear release
         if: steps.release-tag.outputs.tag != ''
-        uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
+        uses: linear/linear-release-action@3f31fcf14c110cc53579fcc3575a26d469c413b4 # v0.17.1
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: complete
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 19cff47a1..dadc3b9c5 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -121,7 +121,7 @@ jobs:
           # tests/bats — the shell test runner. Without it `mise run test:bats`
           # has no bats to run.
           submodules: true
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # cross-check is `rustup target add` + `cargo check`; rust is the only
           # tool it touches. See the ci job for why these lists are narrow.
@@ -202,7 +202,7 @@ jobs:
           bash -c "$body" || exit 0
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # zig supplies the Darwin linker and cargo-zigbuild drives cargo
           # through it; rust is the compiler. Nothing else is invoked here —
@@ -279,7 +279,7 @@ jobs:
           # task passes `--baseline-rev origin/main`, and a shallow clone has no
           # such ref to build the baseline rustdoc from.
           fetch-depth: 0
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # cargo-semver-checks does the comparison; rust supplies the cargo and
           # the rustup that fetches the newer toolchain the tool requires — see
@@ -422,7 +422,7 @@ jobs:
           # carries a suite about that path — and it would read as a Windows
           # finding, which is the misattribution this job exists to avoid.
           submodules: true
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # NOT rust alone, which is what this job shipped with and what the
           # sixth Windows run disproved. `cargo test` is the command, but the
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 6880fac70..323050d07 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -66,7 +66,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # scorecard reads the repository over the API and the checkout from
           # disk; nothing else is invoked. `mise run ci-tools-check` fails if a
diff --git a/.github/workflows/timeout-drift.yml b/.github/workflows/timeout-drift.yml
index 11de3c529..14d56672a 100644
--- a/.github/workflows/timeout-drift.yml
+++ b/.github/workflows/timeout-drift.yml
@@ -56,7 +56,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       # GH_TOKEN goes through env, never interpolated into the run block: a
       # `${{ }}` expansion is textual substitution into the shell script, and
       # zizmor gates that at high severity. All logic is in the task; nothing
diff --git a/.github/workflows/zizmor-advisories.yml b/.github/workflows/zizmor-advisories.yml
index 2be4b1778..ab1ef69de 100644
--- a/.github/workflows/zizmor-advisories.yml
+++ b/.github/workflows/zizmor-advisories.yml
@@ -54,7 +54,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           install_args: zizmor
       - run: mise run zizmor-advisories
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 8db31f421..17e337880 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -115,7 +115,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # The analyzer, plus the `jq` its receipt check needs: the task body is
           # `step-receipt check zizmor` first, and `step-receipt` reads