diff --git a/.github/workflows/agent-refine.yml b/.github/workflows/agent-refine.yml
index dd10aae..a310a28 100644
--- a/.github/workflows/agent-refine.yml
+++ b/.github/workflows/agent-refine.yml
@@ -88,7 +88,7 @@ jobs:
 
       - name: Refine with Claude (Sonnet)
         if: steps.pick.outputs.target != ''
-        uses: anthropics/claude-code-action@v1.0.153
+        uses: anthropics/claude-code-action@v1.0.165
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/agent-review.yml b/.github/workflows/agent-review.yml
index a0357ba..fa1d2a7 100644
--- a/.github/workflows/agent-review.yml
+++ b/.github/workflows/agent-review.yml
@@ -180,7 +180,7 @@ jobs:
           # PreToolUse hook permits THIS session to `gh pr review` (its job).
           # The hook still blocks reviews/merges from local + interactive agents.
           CLABBY_REVIEW_CONTEXT: agent-review
-        uses: anthropics/claude-code-action@v1.0.153
+        uses: anthropics/claude-code-action@v1.0.165
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # Reviewing major Dependabot bumps is this job's purpose, but the action blocks
diff --git a/.github/workflows/ci-complete.yml b/.github/workflows/ci-complete.yml
index 6622cb1..ddb3090 100644
--- a/.github/workflows/ci-complete.yml
+++ b/.github/workflows/ci-complete.yml
@@ -222,7 +222,7 @@ jobs:
 
       # Pinned to match rust-toolchain.toml — bump both together.
       - name: Install Rust (rustfmt + clippy)
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
         with:
           components: rustfmt, clippy
 
@@ -230,7 +230,7 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install cargo-machete
-        uses: taiki-e/install-action@v2.82.1
+        uses: taiki-e/install-action@v2.82.8
         with:
           tool: cargo-machete
 
@@ -264,7 +264,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install Rust (+ llvm-tools)
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
         with:
           components: llvm-tools-preview
 
@@ -396,7 +396,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install Rust (clippy)
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
         with:
           components: clippy
 
diff --git a/.github/workflows/mutants.yml b/.github/workflows/mutants.yml
index d04ccda..7a4ff30 100644
--- a/.github/workflows/mutants.yml
+++ b/.github/workflows/mutants.yml
@@ -36,7 +36,7 @@ jobs:
 
       # Pinned to match rust-toolchain.toml — bump both together.
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
 
       - name: Cache cargo
         uses: Swatinem/rust-cache@v2
@@ -44,7 +44,7 @@ jobs:
       # Pinned for week-over-week reproducibility (mutation operators change between
       # releases). Bump deliberately alongside reviewing any resulting churn.
       - name: Install cargo-mutants
-        uses: taiki-e/install-action@v2.82.1
+        uses: taiki-e/install-action@v2.82.8
         with:
           tool: cargo-mutants@27.1.0