diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 7ed1f69dc0..ed9699cc94 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -29,7 +29,7 @@ runs:
         version: 1.0
 
     - name: Setup node and pnpm
-      uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
+      uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
       with:
         cache: true
         install: false # skip install to run `pnpm ci` instead
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4f7d8a01ae..89c7267fce 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -179,7 +179,7 @@ jobs:
 
       - name: Upload artifacts on failure
         if: failure()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           path: artifacts
 
@@ -244,7 +244,7 @@ jobs:
         run: node scripts/publish-installer-size.mjs linux-${{ matrix.arch }}
 
       - name: Clone backup integration tests
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: 'signalapp/Signal-Message-Backup-Tests'
           ref: 'a0f900243210efbedc72f0907c5d2f140385daa4'
@@ -267,7 +267,7 @@ jobs:
 
       - name: Upload artifacts on failure
         if: failure()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           path: artifacts
 
@@ -336,7 +336,7 @@ jobs:
 
       - name: Upload artifacts on failure
         if: failure()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           path: artifacts
 
@@ -445,7 +445,7 @@ jobs:
 
       - name: Upload mock server test logs on failure
         if: failure()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: logs-${{ matrix.workerIndex.value }}
           path: artifacts
@@ -489,7 +489,7 @@ jobs:
           filter: blob:none
 
       - name: Setup danger environment
-        uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
+        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
         with:
           cache: true
           package-json-file: danger/package.json
@@ -625,13 +625,13 @@ jobs:
 
       - name: Upload benchmark logs on failure
         if: failure()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: logs
           path: artifacts
 
       - name: Clone benchmark repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: 'signalapp/Signal-Desktop-Benchmarks-Private'
           path: 'benchmark-results'
diff --git a/.github/workflows/icu-book.yml b/.github/workflows/icu-book.yml
index 0c6fbfb612..bb742f85aa 100644
--- a/.github/workflows/icu-book.yml
+++ b/.github/workflows/icu-book.yml
@@ -42,7 +42,7 @@ jobs:
 
       - name: Upload test artifacts
         if: github.event_name == 'workflow_dispatch'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: desktop-test-icu
           path: stories
@@ -50,7 +50,7 @@ jobs:
 
       - name: Upload release artifacts
         if: github.event_name != 'workflow_dispatch'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: desktop-${{ github.ref_name }}-icu
           path: stories
diff --git a/.github/workflows/publish-packages.yml b/.github/workflows/publish-packages.yml
index f23fd96fba..315b50390c 100644
--- a/.github/workflows/publish-packages.yml
+++ b/.github/workflows/publish-packages.yml
@@ -32,7 +32,7 @@ jobs:
 
       - name: Publish packages
         id: changesets
-        uses: changesets/action@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.1.1
+        uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
         with:
           commit-message: Publish Packages
           pr-title: Publish Packages
diff --git a/.github/workflows/reproducible-build-scheduler.yml b/.github/workflows/reproducible-build-scheduler.yml
index 5ac643aba2..584f9b54e6 100644
--- a/.github/workflows/reproducible-build-scheduler.yml
+++ b/.github/workflows/reproducible-build-scheduler.yml
@@ -38,7 +38,7 @@ jobs:
 
     - name: Restore previous version file from cache
       id: restore-cache-version
-      uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         key: ${{ matrix.package }}-version-git-ref-txt
         path: ~/version-git-ref.txt
diff --git a/.github/workflows/reproducible-builds.yml b/.github/workflows/reproducible-builds.yml
index 66bc18ed98..4aa7daffc9 100644
--- a/.github/workflows/reproducible-builds.yml
+++ b/.github/workflows/reproducible-builds.yml
@@ -90,7 +90,7 @@ jobs:
         fi
 
     - name: Clone Desktop git repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ steps.app_info.outputs.git_ref }}
 
@@ -107,9 +107,9 @@ jobs:
         echo "pnpm_version=$PNPM_VERSION" >> $GITHUB_OUTPUT
 
     - name: Set up docker Buildx
-      uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
+      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
     - name: Build docker image
-      uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
       env:
         DOCKER_BUILD_RECORD_UPLOAD: false
       with:
diff --git a/packages/mock-server/.github/workflows/publish.yaml b/packages/mock-server/.github/workflows/publish.yaml
index a1737755dc..723d7bb840 100644
--- a/packages/mock-server/.github/workflows/publish.yaml
+++ b/packages/mock-server/.github/workflows/publish.yaml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup pnpm
         uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
diff --git a/packages/mock-server/.github/workflows/test.yaml b/packages/mock-server/.github/workflows/test.yaml
index 597f7e0d96..bb55058315 100644
--- a/packages/mock-server/.github/workflows/test.yaml
+++ b/packages/mock-server/.github/workflows/test.yaml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup pnpm
         uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
       - name: Setup node.js
diff --git a/scripts/update-gha.mjs b/scripts/update-gha.mjs
index 4fcfb6dfd3..74d1479d19 100644
--- a/scripts/update-gha.mjs
+++ b/scripts/update-gha.mjs
@@ -37,8 +37,6 @@ async function updateAction(fullPath) {
     assert(groups != null, 'Expected regexp to fully match');
     const { path, ref, originalRef } = groups;
     assert(path != null, 'Missing path');
-    assert(ref != null, 'Missing ref');
-    assert(originalRef != null, 'Missing originalRef');
 
     // Skip local actions
     if (path.startsWith('.')) {
@@ -50,6 +48,9 @@ async function updateAction(fullPath) {
       continue;
     }
 
+    assert(ref != null, 'Missing ref');
+    assert(originalRef != null, 'Missing originalRef');
+
     const cacheKey = `${path}@${originalRef}`;
     if (CACHE.has(cacheKey)) {
       continue;