diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 73c9269e5..42d6905dd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,7 +28,7 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Setup mise
-        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+        uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
         with:
           experimental: true
 
diff --git a/.github/workflows/comment-to-ai.yml b/.github/workflows/comment-to-ai.yml
index c53199804..1fd032341 100644
--- a/.github/workflows/comment-to-ai.yml
+++ b/.github/workflows/comment-to-ai.yml
@@ -38,7 +38,7 @@ jobs:
         uses: ./.github/actions/git-config
 
       - name: Setup mise
-        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+        uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
         with:
           experimental: true
 
@@ -52,7 +52,7 @@ jobs:
           input-text: ${{ github.event.comment.body }}
 
       - name: Run OpenCode to handle issue
-        uses: anomalyco/opencode/github@d848c9b6a32f408e8b9bf6448b83af05629454d0 # v1.2.13
+        uses: anomalyco/opencode/github@4ee426ba549131c4903a71dfb6259200467aca81 # v1.2.27
         env:
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
           ZHIPU_API_KEY: ${{ secrets.ZHIPU_API_KEY }}
@@ -135,7 +135,7 @@ jobs:
         uses: ./.github/actions/git-config
 
       - name: Setup mise
-        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+        uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
         with:
           experimental: true
 
@@ -149,7 +149,7 @@ jobs:
           input-text: ${{ github.event.comment.body }}
 
       - name: Run OpenCode to handle PR comment
-        uses: anomalyco/opencode/github@d848c9b6a32f408e8b9bf6448b83af05629454d0 # v1.2.13
+        uses: anomalyco/opencode/github@4ee426ba549131c4903a71dfb6259200467aca81 # v1.2.27
         env:
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
           ZHIPU_API_KEY: ${{ secrets.ZHIPU_API_KEY }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 90319a7ae..bc8116f1b 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -25,7 +25,7 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Setup mise
-        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+        uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
         with:
           experimental: true
 
diff --git a/.github/workflows/draft-release.yml b/.github/workflows/draft-release.yml
index 901923a0e..9b6a27bfe 100644
--- a/.github/workflows/draft-release.yml
+++ b/.github/workflows/draft-release.yml
@@ -36,7 +36,7 @@ jobs:
         uses: ./.github/actions/git-config
 
       - name: Setup mise
-        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+        uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
         with:
           experimental: true
 
@@ -53,7 +53,7 @@ jobs:
           input-text: ${{ inputs.model }}
 
       - name: Run OpenCode to draft release
-        uses: anomalyco/opencode/github@d848c9b6a32f408e8b9bf6448b83af05629454d0 # v1.2.13
+        uses: anomalyco/opencode/github@4ee426ba549131c4903a71dfb6259200467aca81 # v1.2.27
         env:
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
           ZHIPU_API_KEY: ${{ secrets.ZHIPU_API_KEY }}
diff --git a/.github/workflows/e2e-binaries.yml b/.github/workflows/e2e-binaries.yml
index acd21f7f8..edf0a495d 100644
--- a/.github/workflows/e2e-binaries.yml
+++ b/.github/workflows/e2e-binaries.yml
@@ -30,7 +30,7 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Setup mise
-        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v2
+        uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v2
         with:
           experimental: true
 
@@ -47,7 +47,7 @@ jobs:
           bun build --compile --minify --sourcemap --target=bun-windows-x64 --outfile=dist-bun/rulesync-windows-x64.exe ./src/cli/index.ts
 
       - name: Cache binaries
-        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: dist-bun
           key: rulesync-binaries-${{ github.sha }}
@@ -66,7 +66,7 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Restore cached binaries
-        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: dist-bun
           key: rulesync-binaries-${{ github.sha }}
@@ -99,7 +99,7 @@ jobs:
           echo "BINARY_PATH=dist-bun/rulesync-windows-x64.exe" >> "$GITHUB_ENV"
 
       - name: Setup mise
-        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v2
+        uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v2
         with:
           experimental: true
 
diff --git a/.github/workflows/publish-assets.yml b/.github/workflows/publish-assets.yml
index 0ba887750..d81da52a4 100644
--- a/.github/workflows/publish-assets.yml
+++ b/.github/workflows/publish-assets.yml
@@ -33,7 +33,7 @@ jobs:
           ref: main
 
       - name: Setup mise
-        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v2
+        uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v2
         with:
           experimental: true
 
@@ -79,7 +79,7 @@ jobs:
           HEAD_REF: ${{ github.event.pull_request.head.ref }}
 
       - name: Upload assets to release
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
         with:
           tag_name: ${{ steps.tag.outputs.tag }}
           draft: true
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 5dea4c824..c1210d0d8 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -22,7 +22,7 @@ jobs:
           ref: main
 
       - name: Setup mise
-        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v2
+        uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v2
         with:
           experimental: true
 
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 3020d4d51..a540a33e0 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -19,7 +19,7 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Setup mise
-        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+        uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
         with:
           experimental: true