diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 92df8f5..c3a863e 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -7,7 +7,17 @@ on:
   pull_request_target:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number || github.run_id }}
+  # Only share a concurrency group with runs that can actually perform the check
+  # (a `pull_request_target` event, or an `issue_comment` that is a `@conda-bot check`
+  # request). Every other `issue_comment` (bot noise, unrelated comments, etc.) is
+  # skipped by the job's `if:` below anyway, but without this it would still join the
+  # same group and cancel an in-progress, legitimate CLA check.
+  group: >-
+    ${{ github.workflow }}-${{
+      (github.event_name == 'pull_request_target' || github.event.comment.body == '@conda-bot check')
+      && (github.event.pull_request.number || github.event.issue.number)
+      || github.run_id
+    }}
   cancel-in-progress: true
 
 permissions:
@@ -30,7 +40,7 @@ jobs:
       statuses: write  # Required to publish the CLA commit status.
     steps:
       - name: Check CLA
-        uses: conda/actions/check-cla@d88418cd4e36358ba51e7c88f2d2d5edb9ac49e7 # v26.8.1
+        uses: conda/actions/check-cla@c8ad4261cc1d49709cb774289c68e63663bdc9d5 # v26.9.5
         with:
           # [required]
           # A token with ability to comment, label, and modify the commit status
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 6de824c..558cfa5 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -40,7 +40,7 @@ jobs:
             days-before-issue-stale: 90
             days-before-issue-close: 21
     steps:
-      - uses: conda/actions/read-file@d88418cd4e36358ba51e7c88f2d2d5edb9ac49e7 # v26.8.1
+      - uses: conda/actions/read-file@c8ad4261cc1d49709cb774289c68e63663bdc9d5 # v26.9.5
         id: read_messages
         with:
           path: https://raw.githubusercontent.com/conda/infra/main/.github/messages.yml
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index d852933..6a7c64f 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -33,11 +33,11 @@ jobs:
           git config --global user.name 'Conda Bot'
           git config --global user.email '18747875+conda-bot@users.noreply.github.com'
 
-      - uses: conda/actions/combine-durations@d88418cd4e36358ba51e7c88f2d2d5edb9ac49e7 # v26.8.1
+      - uses: conda/actions/combine-durations@c8ad4261cc1d49709cb774289c68e63663bdc9d5 # v26.9.5
         id: durations
         continue-on-error: true
 
-      - uses: conda/actions/template-files@d88418cd4e36358ba51e7c88f2d2d5edb9ac49e7 # v26.8.1
+      - uses: conda/actions/template-files@c8ad4261cc1d49709cb774289c68e63663bdc9d5 # v26.9.5
         id: templates
         continue-on-error: true
 
@@ -51,11 +51,33 @@ jobs:
       - name: Create fork
         # no-op if the repository is already forked
         run: |
-          FORK="$(gh repo fork --clone=false --default-branch-only 2>&1 | awk '{print $1}' | sed 's|^https://github.com/||')"
+          FORK="$(gh api repos/:owner/:repo/forks --method POST -f default_branch_only=true --jq .full_name)"
           echo "FORK=${FORK}" >> "$GITHUB_ENV"
         env:
           GH_TOKEN: ${{ secrets.SYNC_TOKEN }}
 
+      - name: Compose pull request body
+        # written to disk (instead of `body:`) to avoid E2BIG ("Argument list
+        # too long") when large summaries are passed as action inputs
+        run: |
+          cat >> "$RUNNER_TEMP/pr-body.md" <<EOF
+          [update.yml]: $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/blob/main/.github/workflows/update.yml
+
+          Your friendly repository updater.
+
+          $DURATIONS_SUMMARY
+
+          $TEMPLATES_SUMMARY
+
+          This PR was triggered by @$GITHUB_TRIGGERING_ACTOR via $GITHUB_EVENT_NAME.
+
+          ###### Auto-generated by the [\`update.yml\`][update.yml] workflow, see $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID.
+          EOF
+        env:
+          DURATIONS_SUMMARY: ${{ steps.durations.outputs.summary }}
+          TEMPLATES_SUMMARY: ${{ steps.templates.outputs.summary }}
+          GITHUB_TRIGGERING_ACTOR: ${{ github.triggering_actor }}
+
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           push-to-fork: ${{ env.FORK }}
@@ -63,15 +85,4 @@ jobs:
           branch: update
           delete-branch: true
           title: 🤖 Update infrastructure file(s)
-          body: |
-            [update.yml]: ${{ github.server_url }}/${{ github.repository }}/blob/main/.github/workflows/update.yml
-
-            Your friendly repository updater.
-
-            ${{ steps.durations.outputs.summary }}
-
-            ${{ steps.templates.outputs.summary }}
-
-            This PR was triggered by @${{ github.triggering_actor }} via ${{ github.event_name }}.
-
-            ###### Auto-generated by the [`update.yml`][update.yml] workflow, see ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}.
+          body-path: ${{ runner.temp }}/pr-body.md