diff --git a/.github/workflows/lib-ci-dotnet.yml b/.github/workflows/lib-ci-dotnet.yml
index 2858c0b..25939d2 100644
--- a/.github/workflows/lib-ci-dotnet.yml
+++ b/.github/workflows/lib-ci-dotnet.yml
@@ -65,7 +65,7 @@ jobs:
     name: "Security: SCA"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: "Security: SCA Scanning"
         uses: mmastersvz/central-ci/actions/security-sca-scans@main
@@ -86,7 +86,7 @@ jobs:
       docker-tags: ${{ steps.setup-docker.outputs.docker-tags }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -116,12 +116,12 @@ jobs:
           app-version: ${{ steps.prep.outputs.build-version }}
 
       - name: "Setup: .NET"
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ steps.setup-app.outputs.dotnet-version }}
 
       - name: "Cache: NuGet packages"
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.nuget/packages
           key: nuget-${{ runner.os }}-${{ hashFiles('**/packages.lock.json', '**/*.csproj') }}
@@ -140,10 +140,10 @@ jobs:
         working-directory: ${{ inputs.app-dir }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: "Cache: NuGet packages"
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.nuget/packages
           key: nuget-${{ runner.os }}-${{ hashFiles('**/packages.lock.json', '**/*.csproj') }}
diff --git a/.github/workflows/lib-ci-go.yml b/.github/workflows/lib-ci-go.yml
index ad3518e..eb81222 100644
--- a/.github/workflows/lib-ci-go.yml
+++ b/.github/workflows/lib-ci-go.yml
@@ -71,7 +71,7 @@ jobs:
     name: "Security: SCA"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: "Security: SCA Scanning"
         uses: mmastersvz/central-ci/actions/security-sca-scans@main
@@ -92,7 +92,7 @@ jobs:
       docker-tags: ${{ steps.setup-docker.outputs.docker-tags }}
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -138,7 +138,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: setup
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: "Build: Run Go CI"
         uses: mmastersvz/central-ci/actions/go-build-test@main
@@ -146,7 +146,7 @@ jobs:
           app-dir: ${{ inputs.app-dir }}
 
       - name: "Cache: Go tools (govulncheck)"
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/go/bin
           key: go-tools-${{ runner.os }}-govulncheck
diff --git a/.github/workflows/lib-ci-java.yml b/.github/workflows/lib-ci-java.yml
index d44d6ea..83f2630 100644
--- a/.github/workflows/lib-ci-java.yml
+++ b/.github/workflows/lib-ci-java.yml
@@ -80,7 +80,7 @@ jobs:
     name: "Security: SCA"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: "Security: SCA Scanning"
         uses: mmastersvz/central-ci/actions/security-sca-scans@main
@@ -103,7 +103,7 @@ jobs:
       docker-tags: ${{ steps.setup-docker.outputs.docker-tags }}
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -145,7 +145,7 @@ jobs:
           app-version: ${{ steps.prep.outputs.build-version }}
 
       - name: "Setup: JDK"
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: "${{ steps.tools.outputs.java-distribution }}"
           java-version: "${{ steps.tools.outputs.java-version }}"
@@ -169,10 +169,10 @@ jobs:
         working-directory: ${{ inputs.app-dir }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: "Setup: JDK ${{ needs.setup.outputs.java-version }}"
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: ${{ needs.setup.outputs.java-version }}
           distribution: ${{ needs.setup.outputs.java-distribution }}
diff --git a/.github/workflows/lib-ci-node.yml b/.github/workflows/lib-ci-node.yml
index 309bab2..dfa9881 100644
--- a/.github/workflows/lib-ci-node.yml
+++ b/.github/workflows/lib-ci-node.yml
@@ -72,7 +72,7 @@ jobs:
     name: "Security: SCA"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: "Security: SCA Scanning"
         uses: mmastersvz/central-ci/actions/security-sca-scans@main
@@ -93,7 +93,7 @@ jobs:
       docker-tags: ${{ steps.setup-docker.outputs.docker-tags }}
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -142,10 +142,10 @@ jobs:
         working-directory: ${{ inputs.app-dir }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Node ${{ needs.setup.outputs.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ needs.setup.outputs.node-version }}
           cache: npm
diff --git a/.github/workflows/lib-ci-python.yml b/.github/workflows/lib-ci-python.yml
index f5104d8..9ebad91 100644
--- a/.github/workflows/lib-ci-python.yml
+++ b/.github/workflows/lib-ci-python.yml
@@ -80,7 +80,7 @@ jobs:
     name: "Security: SCA"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: "Security: SCA Scanning"
         uses: mmastersvz/central-ci/actions/security-sca-scans@main
@@ -101,7 +101,7 @@ jobs:
       docker-tags: ${{ steps.setup-docker.outputs.docker-tags }}
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -148,10 +148,10 @@ jobs:
         working-directory: ${{ inputs.app-dir }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: "Setup Python: ${{ needs.setup.outputs.python-version }}"
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ needs.setup.outputs.python-version }}
           cache: pip
diff --git a/.github/workflows/lib-ci-standard.yml b/.github/workflows/lib-ci-standard.yml
index cdaefa2..f94d0c3 100644
--- a/.github/workflows/lib-ci-standard.yml
+++ b/.github/workflows/lib-ci-standard.yml
@@ -34,7 +34,7 @@ jobs:
       pull-requests: write # optional for comments
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -46,7 +46,7 @@ jobs:
 
       # Secret scanning (early fail)
       - name: Secret Detection (TruffleHog)
-        uses: trufflesecurity/trufflehog@v3.94.3
+        uses: trufflesecurity/trufflehog@v3.95.2
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || github.sha }}
diff --git a/.github/workflows/lib-test-oci.yml b/.github/workflows/lib-test-oci.yml
index 94dbfa0..c894148 100644
--- a/.github/workflows/lib-test-oci.yml
+++ b/.github/workflows/lib-test-oci.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Exchange GitHub OIDC for OCI Session Token
         uses: gtrevorrow/oci-token-exchange-action@v1
diff --git a/.github/workflows/lib-tf-oci-apply.yml b/.github/workflows/lib-tf-oci-apply.yml
index c29eaa5..3847e69 100644
--- a/.github/workflows/lib-tf-oci-apply.yml
+++ b/.github/workflows/lib-tf-oci-apply.yml
@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Exchange GitHub OIDC for OCI Session Token
         uses: gtrevorrow/oci-token-exchange-action@v1
@@ -52,7 +52,7 @@ jobs:
           terraform_version: ${{ inputs.terraform-version }}
 
       - name: Cache Terraform providers
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.terraform.d/plugin-cache
diff --git a/.github/workflows/lib-tf-oci-plan.yml b/.github/workflows/lib-tf-oci-plan.yml
index bc06f79..5d530a1 100644
--- a/.github/workflows/lib-tf-oci-plan.yml
+++ b/.github/workflows/lib-tf-oci-plan.yml
@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -59,7 +59,7 @@ jobs:
           terraform_version: ${{ inputs.terraform-version }}
 
       - name: Cache Terraform providers
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.terraform.d/plugin-cache
diff --git a/.github/workflows/test-go-build-test.yml b/.github/workflows/test-go-build-test.yml
index ede235c..0a29ba0 100644
--- a/.github/workflows/test-go-build-test.yml
+++ b/.github/workflows/test-go-build-test.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Run go-build-test against fixture app"
         uses: ./actions/go-build-test
diff --git a/.github/workflows/test-security-sast-post-scans.yml b/.github/workflows/test-security-sast-post-scans.yml
index e615404..234e44d 100644
--- a/.github/workflows/test-security-sast-post-scans.yml
+++ b/.github/workflows/test-security-sast-post-scans.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Run security-sast-post-scans with CodeQL skipped"
         uses: ./actions/security-sast-post-scans
@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Run security-sast-post-scans for javascript"
         uses: ./actions/security-sast-post-scans
diff --git a/.github/workflows/test-security-sast-pre-scans.yml b/.github/workflows/test-security-sast-pre-scans.yml
index 74d7f6e..9782cd0 100644
--- a/.github/workflows/test-security-sast-pre-scans.yml
+++ b/.github/workflows/test-security-sast-pre-scans.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Run security-sast-pre-scans with semgrep skipped"
         uses: ./actions/security-sast-pre-scans
@@ -39,7 +39,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Run security-sast-pre-scans in OSS mode"
         id: sast
diff --git a/.github/workflows/test-security-sca-scans.yml b/.github/workflows/test-security-sca-scans.yml
index bf7a1f8..37c6374 100644
--- a/.github/workflows/test-security-sca-scans.yml
+++ b/.github/workflows/test-security-sca-scans.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Run security-sca-scans against repo root"
         id: sca
@@ -48,7 +48,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Run security-sca-scans with CRITICAL only"
         uses: ./actions/security-sca-scans
diff --git a/.github/workflows/test-setup-docker.yml b/.github/workflows/test-setup-docker.yml
index 4c1a9ac..8bf0d36 100644
--- a/.github/workflows/test-setup-docker.yml
+++ b/.github/workflows/test-setup-docker.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Run setup-docker"
         id: docker
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Run setup-docker"
         id: docker
@@ -101,7 +101,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Run setup-docker"
         id: docker
diff --git a/.github/workflows/test-setup-tools.yml b/.github/workflows/test-setup-tools.yml
index 5a7d82e..126a401 100644
--- a/.github/workflows/test-setup-tools.yml
+++ b/.github/workflows/test-setup-tools.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Create fixture .tool-versions"
         shell: bash
@@ -59,7 +59,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Create fixture .tool-versions"
         shell: bash
@@ -108,7 +108,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Create fixture .tool-versions (no rust entry)"
         shell: bash