diff --git a/.github/scripts/pull-request-dashboard/test_rollout.py b/.github/scripts/pull-request-dashboard/test_rollout.py
index 66c5ae57e3f6..d62ebd1f7f54 100644
--- a/.github/scripts/pull-request-dashboard/test_rollout.py
+++ b/.github/scripts/pull-request-dashboard/test_rollout.py
@@ -89,14 +89,14 @@ def test_each_drain_job_receives_the_selected_lane_without_github_concurrency(se
                 )
 
     def test_both_classifier_entry_paths_install_the_sdk_runtime(self) -> None:
-        for path, requirements in (
-            (REPO_WORKFLOW, '"$DASHBOARD_CODE/requirements.txt"'),
-            (DRAIN_WORKFLOW, ".github/scripts/pull-request-dashboard/requirements.txt"),
+        for path, job, requirements in (
+            (REPO_WORKFLOW, "update-dashboard", '"$DASHBOARD_CODE/requirements.txt"'),
+            (DRAIN_WORKFLOW, "drain", ".github/scripts/pull-request-dashboard/requirements.txt"),
         ):
-            with self.subTest(workflow=path.name):
-                text = path.read_text(encoding="utf-8")
+            with self.subTest(workflow=path.name, job=job):
+                text = job_blocks(path.read_text(encoding="utf-8"))[job]
                 self.assertIn("actions/setup-python@", text)
-                self.assertIn("python-version: '3.14'", text)
+                self.assertRegex(text, r"(?m)^ +python-version: ['\"]3\.\d+['\"]$")
                 self.assertIn(f"python -m pip install -r {requirements}", text)
                 self.assertIn("python -m copilot download-runtime", text)
                 self.assertLess(
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f56f5c71322a..3ae4643b4582 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -41,12 +41,12 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/github-actions-queue-collector.yml b/.github/workflows/github-actions-queue-collector.yml
index 00cc0c86385c..6bb7d8e2416b 100644
--- a/.github/workflows/github-actions-queue-collector.yml
+++ b/.github/workflows/github-actions-queue-collector.yml
@@ -47,7 +47,7 @@ jobs:
             echo EOF
           } >> "$GITHUB_OUTPUT"
 
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: collector-token
         with:
           client-id: ${{ vars.ACTIONS_TELEMETRY_CLIENT_ID }}
diff --git a/.github/workflows/promote-pull-request-dashboard.yml b/.github/workflows/promote-pull-request-dashboard.yml
index 9417854e884f..4039aa318a95 100644
--- a/.github/workflows/promote-pull-request-dashboard.yml
+++ b/.github/workflows/promote-pull-request-dashboard.yml
@@ -78,7 +78,7 @@ jobs:
         working-directory: .github/scripts/pull-request-dashboard
         run: python3 -m unittest discover -p 'test_*.py'
 
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: otelbot-token
         with:
           client-id: ${{ vars.OTELBOT_SHARED_WORKFLOWS_CLIENT_ID }}
diff --git a/.github/workflows/pull-request-dashboard-deploy-webhook.yml b/.github/workflows/pull-request-dashboard-deploy-webhook.yml
index 2de294a89a73..52e2391fdfdd 100644
--- a/.github/workflows/pull-request-dashboard-deploy-webhook.yml
+++ b/.github/workflows/pull-request-dashboard-deploy-webhook.yml
@@ -43,7 +43,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           package-manager-cache: false
diff --git a/.github/workflows/pull-request-dashboard-drain.yml b/.github/workflows/pull-request-dashboard-drain.yml
index 05dff3bbc601..38aa164f2985 100644
--- a/.github/workflows/pull-request-dashboard-drain.yml
+++ b/.github/workflows/pull-request-dashboard-drain.yml
@@ -42,13 +42,13 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           package-manager-cache: false
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.14'
+          python-version: '3.15'
       - name: Install worker dependencies
         run: |
           npm ci --prefix .github/scripts/pull-request-dashboard
@@ -107,7 +107,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           package-manager-cache: false
@@ -138,7 +138,7 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         if: steps.claim.outcome == 'success' && steps.claim.outputs.count != '0'
         with:
-          python-version: '3.14'
+          python-version: '3.15'
 
       - name: Install dashboard dependencies
         if: steps.claim.outcome == 'success' && steps.claim.outputs.count != '0'
diff --git a/.github/workflows/pull-request-dashboard-refresh-author-nudges.yml b/.github/workflows/pull-request-dashboard-refresh-author-nudges.yml
index 441174f39c57..52139bf4cd0d 100644
--- a/.github/workflows/pull-request-dashboard-refresh-author-nudges.yml
+++ b/.github/workflows/pull-request-dashboard-refresh-author-nudges.yml
@@ -101,7 +101,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: dashboard-token
         with:
           client-id: ${{ vars.PR_DASHBOARD_CLIENT_ID }}
diff --git a/.github/workflows/pull-request-dashboard-repo.yml b/.github/workflows/pull-request-dashboard-repo.yml
index f1f896a567b5..1e01960adea2 100644
--- a/.github/workflows/pull-request-dashboard-repo.yml
+++ b/.github/workflows/pull-request-dashboard-repo.yml
@@ -93,7 +93,7 @@ jobs:
             echo "require_clean_copilot_review_branches_json=$(jq -c '.require_clean_copilot_review_branches // []' <<< "$entry")"
           } >> "$GITHUB_OUTPUT"
 
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: dashboard-token
         with:
           client-id: ${{ vars.PR_DASHBOARD_CLIENT_ID }}
@@ -127,14 +127,14 @@ jobs:
             pull-request-dashboard-classifications-${{ steps.config.outputs.name }}-all-
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           package-manager-cache: false
 
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.14'
+          python-version: '3.15'
 
       - name: Install dashboard dependencies
         env:
@@ -278,7 +278,7 @@ jobs:
             echo "labels_to_display_json=$(jq -c '.labels_to_display // []' <<< "$entry")"
           } >> "$GITHUB_OUTPUT"
 
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: dashboard-token
         with:
           client-id: ${{ vars.PR_DASHBOARD_CLIENT_ID }}
diff --git a/.github/workflows/pull-request-dashboard-test.yml b/.github/workflows/pull-request-dashboard-test.yml
index 1346b5d44ede..2e683432b1b0 100644
--- a/.github/workflows/pull-request-dashboard-test.yml
+++ b/.github/workflows/pull-request-dashboard-test.yml
@@ -23,7 +23,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           package-manager-cache: false
@@ -34,7 +34,7 @@ jobs:
 
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.14'
+          python-version: '3.15'
 
       - name: Install Python dependencies
         working-directory: .github/scripts/pull-request-dashboard
diff --git a/.github/workflows/pull-request-dashboard.yml b/.github/workflows/pull-request-dashboard.yml
index 3c7ba6a14ac3..106f29ac2d63 100644
--- a/.github/workflows/pull-request-dashboard.yml
+++ b/.github/workflows/pull-request-dashboard.yml
@@ -196,7 +196,7 @@ jobs:
             echo "channel=stable" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: head-sha-token
         with:
           client-id: ${{ vars.PR_DASHBOARD_CLIENT_ID }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 53fd94973a3d..f201312677de 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -59,7 +59,7 @@ jobs:
     steps:
       - name: Harden the runner (Audit all outbound calls)
         if: inputs['use-harden-runner']
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 
@@ -77,7 +77,7 @@ jobs:
       # Also hands the results to the upload job below.
       # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
       - name: "Upload artifact"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: SARIF file
           path: results.sarif
@@ -93,7 +93,7 @@ jobs:
     steps:
       - name: Harden the runner (Audit all outbound calls)
         if: inputs['use-harden-runner']
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 
@@ -101,7 +101,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: SARIF file
 
@@ -125,6 +125,6 @@ jobs:
           echo "kept $(jq '[.runs[] | (.results // [])[]] | length' filtered.sarif) of $(jq '[.runs[] | (.results // [])[]] | length' results.sarif) results"
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: filtered.sarif
diff --git a/.github/workflows/survey-on-merged-pr.yml b/.github/workflows/survey-on-merged-pr.yml
index d67806be5f20..341fb1485ef1 100644
--- a/.github/workflows/survey-on-merged-pr.yml
+++ b/.github/workflows/survey-on-merged-pr.yml
@@ -29,7 +29,7 @@ jobs:
       github.repository_owner == 'open-telemetry' &&
       github.event.pull_request.user.type != 'Bot'
     steps:
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: otelbot-token
         with:
           client-id: ${{ inputs.client_id }}