diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ab9bd65..bfbd892 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
           cache: "npm"
 
       - name: Provision pinned standards tools
-        uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
 
       - name: Install dependencies
         run: npm ci
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 0128580..8704f3f 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -131,7 +131,7 @@ jobs:
         # must not turn a failed vulnerability gate into a successful publish.
         if: ${{ !cancelled() && github.event_name != 'pull_request' }}
         continue-on-error: true # kit-self-audit: allow-continue-on-error
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: trivy-results.sarif
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 43ae65d..cb1f4fe 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -30,7 +30,7 @@ jobs:
         # Informational metric; Code Scanning is not enabled on this repo, so
         # SARIF upload errors should not fail master CI.
         continue-on-error: true # kit-self-audit: allow-continue-on-error
-        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
         with:
           results_file: scorecard-results.sarif
           results_format: sarif
@@ -48,6 +48,6 @@ jobs:
         # Lands in repo's Security → Code scanning tab.
         if: always()
         continue-on-error: true # kit-self-audit: allow-continue-on-error
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: scorecard-results.sarif
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 8865460..868d793 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -159,12 +159,12 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: javascript-typescript
           queries: security-extended
       - name: Analyze JavaScript and TypeScript
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           category: "/language:javascript-typescript"
 
@@ -212,7 +212,7 @@ jobs:
         # Don't fail the job if Code Scanning is off — scan result is the gate.
         if: always()
         continue-on-error: true # kit-self-audit: allow-continue-on-error
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: trivy-results.sarif
 
@@ -230,7 +230,7 @@ jobs:
       - name: Checkov (terraform + kubernetes)
         # Baseline of pre-existing findings in .checkov.yaml skip-check.
         # Gating on net-new findings only — see .checkov.yaml header for context.
-        uses: bridgecrewio/checkov-action@c13aafd679d3814a25067d10fcaf98c4f7594931 # v12.3131.0
+        uses: bridgecrewio/checkov-action@6f26dc90000b74feb589a906cdfae540f5119895 # v12.3134.0
         with:
           directory: .
           config_file: .checkov.yaml
@@ -248,7 +248,7 @@ jobs:
         # SARIF upload requires Code Scanning enabled in repo settings.
         if: always()
         continue-on-error: true # kit-self-audit: allow-continue-on-error
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: checkov.sarif
 
@@ -382,7 +382,7 @@ jobs:
           node-version: "22"
           cache: "npm"
       - run: npm ci && npm run build
-      - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1
+      - uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
       # Triage verifies each tool's upstream repo through the GitHub API. Anonymous calls share
       # a 60/hour limit per runner IP, and triage correctly fails closed when it cannot verify.
       - name: Provision declared tools via kit install (triage-gated)
diff --git a/src/browser-strategy.test.ts b/src/browser-strategy.test.ts
index fc268af..a701ba1 100644
--- a/src/browser-strategy.test.ts
+++ b/src/browser-strategy.test.ts
@@ -163,7 +163,7 @@ describe("system Chrome selection", () => {
       assert.equal(result.status, "blocker");
       assert.equal(result.strategy, "none");
     } finally {
-      rmSync(path, { recursive: true, force: true });
+      rmSync(path, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 });
     }
   });
 });
@@ -224,7 +224,7 @@ describe("system Chrome fallback", () => {
         join(second, valid),
       );
     } finally {
-      rmSync(root, { recursive: true, force: true });
+      rmSync(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 });
     }
   });
 });
diff --git a/src/check-secrets-infisical.test.ts b/src/check-secrets-infisical.test.ts
index e2917b6..98ea3f3 100644
--- a/src/check-secrets-infisical.test.ts
+++ b/src/check-secrets-infisical.test.ts
@@ -142,7 +142,7 @@ function fallback(
         .map((line) => JSON.parse(line)),
     };
   } finally {
-    rmSync(dir, { recursive: true, force: true });
+    rmSync(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 });
   }
 }
 
diff --git a/src/github-codeql-workflow.test.ts b/src/github-codeql-workflow.test.ts
index 13cf9a6..ffb6c1f 100644
--- a/src/github-codeql-workflow.test.ts
+++ b/src/github-codeql-workflow.test.ts
@@ -5,7 +5,7 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const CODEQL_ACTION_SHA = "24c54180a607b1449ed407dd24f251e4e9147c8d";
+const CODEQL_ACTION_SHA = "6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee";
 
 describe("CodeQL workflow action", () => {
   it("uses one supported v4 action commit for every CodeQL step", () => {
@@ -20,7 +20,7 @@ describe("CodeQL workflow action", () => {
     assert.ok(references.length > 0, "expected at least one CodeQL action step");
     for (const reference of references) {
       assert.equal(reference.sha, CODEQL_ACTION_SHA, `${reference.name} has a stale CodeQL pin`);
-      assert.equal(reference.version, "v4.38.3", `${reference.name} must identify supported major`);
+      assert.equal(reference.version, "v4.39.0", `${reference.name} must identify supported major`);
     }
   });
 });
diff --git a/src/github-workflow-hardening.test.ts b/src/github-workflow-hardening.test.ts
index 6f31c2e..a086874 100644
--- a/src/github-workflow-hardening.test.ts
+++ b/src/github-workflow-hardening.test.ts
@@ -103,7 +103,7 @@ describe("informational CI jobs can still fail", () => {
 describe("GitHub workflow standards gate", () => {
   it("provisions the pinned standards tools and runs the full standards gate in CI", () => {
     const ci = workflow("ci.yml");
-    assert.match(ci, /uses:\s*jdx\/mise-action@[a-f0-9]{40}\s*#\s*v5\.1\.1/);
+    assert.match(ci, /uses:\s*jdx\/mise-action@[a-f0-9]{40}\s*#\s*v5\.2\.0/);
     assert.match(ci, /run:\s*node dist\/cli\.js standards --enforce/);
     assert.doesNotMatch(
       ci,
diff --git a/src/publish-workflow.test.ts b/src/publish-workflow.test.ts
index 3f9cfcb..4d3d66a 100644
--- a/src/publish-workflow.test.ts
+++ b/src/publish-workflow.test.ts
@@ -228,7 +228,7 @@ describe(
         const neutered = script.replace(/exit 1/g, "true");
         assert.equal(runScript(neutered, root, { TAG: "v9.9.9" }).status, 0, "the check bites");
       } finally {
-        rmSync(root, { recursive: true, force: true });
+        rmSync(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 });
       }
     });
 
@@ -245,7 +245,7 @@ describe(
         const neutered = script.replace(/exit 1/g, "true");
         assert.equal(runScript(neutered, root, { TAG: "v1.2.4" }).status, 0, "the check bites");
       } finally {
-        rmSync(root, { recursive: true, force: true });
+        rmSync(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 });
       }
     });
   },
@@ -428,7 +428,7 @@ describe("publish.yml — published versions bind to the source tree", () => {
       assert.equal(offline.status, 1, offline.stderr);
       assert.match(offline.stderr, /registry lookup failed/);
     } finally {
-      rmSync(root, { recursive: true, force: true });
+      rmSync(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 });
     }
   });
 });
diff --git a/src/triage-cwd.test.ts b/src/triage-cwd.test.ts
index 3ef6d88..ae5b898 100644
--- a/src/triage-cwd.test.ts
+++ b/src/triage-cwd.test.ts
@@ -137,7 +137,7 @@ async function withServer(
   } finally {
     await client.close();
     await transport.close();
-    rmSync(root, { recursive: true, force: true });
+    rmSync(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 });
   }
 }
 
diff --git a/src/upgrade-provenance.test.ts b/src/upgrade-provenance.test.ts
index c49f3ee..1dde9b9 100644
--- a/src/upgrade-provenance.test.ts
+++ b/src/upgrade-provenance.test.ts
@@ -64,7 +64,7 @@ describe("kit upgrade CLI lock provenance", () => {
         "committed locks must not contain machine-specific absolute paths",
       );
     } finally {
-      rmSync(project, { recursive: true, force: true });
+      rmSync(project, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 });
     }
   });
 });