diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 61ee08db9919bb..37d9121dadfc8f 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -12,3 +12,6 @@ paths:
      ignore:
      - 1st argument of function call is not assignable
      - SC2(015|038|086|091|097|098|129|155)
+     # Pending release of actionlint > 1.7.12 for `$/` self-repository syntax:
+     # https://github.com/rhysd/actionlint/issues/711
+     - reusable workflow call "\$/[^"]+" at "uses" is not following the format
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 00000000000000..9e4ec30ba9d254
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,161 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/build.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.0.0'
+        - 'actions/upload-artifact@v7.0.1'
+        - 're-actors/alls-green@v1.3.0'
+    '.github/workflows/cache-cleanup-codeql.yml': []
+    '.github/workflows/jit.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.0.0'
+    '.github/workflows/lint.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'j178/prek-action@v3.0.0'
+    '.github/workflows/mypy.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'astral-sh/setup-uv@v10.2.0'
+    '.github/workflows/new-bugs-announce-notifier.yml':
+        - 'actions/github-script@v9.0.0'
+        - 'actions/setup-node@v7.0.0'
+    '.github/workflows/require-pr-label.yml':
+        - 'mheap/github-action-required-labels@v5.6.0'
+    '.github/workflows/reusable-check-c-api-docs.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.0.0'
+    '.github/workflows/reusable-check-html-ids.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.1'
+        - 'actions/setup-python@v7.0.0'
+    '.github/workflows/reusable-cifuzz.yml':
+        - 'actions/upload-artifact@v7.0.1'
+        - 'github/codeql-action@v4.38.2'
+        - 'google/oss-fuzz@ed23f8af80ff82b25ca67cd9b101e690b8897b3f'
+    '.github/workflows/reusable-context.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.0.0'
+    '.github/workflows/reusable-docs.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.0.0'
+        - 'actions/upload-artifact@v7.0.1'
+    '.github/workflows/reusable-emscripten.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-node@v7.0.0'
+        - 'actions/setup-python@v7.0.0'
+    '.github/workflows/reusable-install.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/reusable-macos.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/reusable-san.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/upload-artifact@v7.0.1'
+    '.github/workflows/reusable-test-lazy-imports-all.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/reusable-ubuntu.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/reusable-wasi.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.0.0'
+        - 'bytecodealliance/actions@v1.1.3'
+        - 'bytecodealliance/setup-wasi-sdk-action@v1.0.0'
+    '.github/workflows/reusable-windows.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/stale.yml':
+        - 'actions/stale@v11.0.0'
+    '.github/workflows/tail-call.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.0.0'
+    '.github/workflows/verify-ensurepip-wheels.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.0.0'
+    '.github/workflows/verify-expat.yml':
+        - 'actions/checkout@v7.0.1'
+dependencies:
+    'actions/cache@v6.1.0':
+        ref: 'v6.1.0'
+        commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/download-artifact@v8.0.1':
+        ref: 'v8.0.1'
+        commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/github-script@v9.0.0':
+        ref: 'v9.0.0'
+        commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/setup-node@v7.0.0':
+        ref: 'v7.0.0'
+        commit: 'sha1-820762786026740c76f36085b0efc47a31fe5020'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/setup-python@v7.0.0':
+        ref: 'v7.0.0'
+        commit: 'sha1-5fda3b95a4ea91299a34e894583c3862153e4b97'
+        owner_id: 44036562
+        repo_id: 192625525
+    'actions/stale@v11.0.0':
+        ref: 'v11.0.0'
+        commit: 'sha1-4391f3da665fdf50b6810c1a66712fb9ba21aa93'
+        owner_id: 44036562
+        repo_id: 200437066
+    'actions/upload-artifact@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        owner_id: 44036562
+        repo_id: 192625955
+    'astral-sh/setup-uv@v10.2.0':
+        ref: 'v10.2.0'
+        commit: 'sha1-c18668ad3cf93ea998bef934396af7bb5c839dc7'
+        owner_id: 115962839
+        repo_id: 846733598
+    'bytecodealliance/actions@v1.1.3':
+        ref: 'v1.1.3'
+        commit: 'sha1-9152e710e9f7182e4c29ad218e4f335a7b203613'
+        owner_id: 54038801
+        repo_id: 697422232
+    'bytecodealliance/setup-wasi-sdk-action@v1.0.0':
+        ref: 'v1.0.0'
+        commit: 'sha1-77d09f3df1e8da344d8403cf8631af8977938b4c'
+        owner_id: 54038801
+        repo_id: 1113975359
+    'github/codeql-action@v4.38.2':
+        ref: 'v4.38.2'
+        commit: 'sha1-2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2'
+        owner_id: 9919
+        repo_id: 259445878
+    'google/oss-fuzz@ed23f8af80ff82b25ca67cd9b101e690b8897b3f':
+        ref: 'master'
+        commit: 'sha1-ed23f8af80ff82b25ca67cd9b101e690b8897b3f'
+        owner_id: 1342004
+        repo_id: 63809205
+    'j178/prek-action@v3.0.0':
+        ref: 'v3.0.0'
+        commit: 'sha1-4e14d07f9231acabce116ccfca13b13dd9755ece'
+        owner_id: 10510431
+        repo_id: 1052387486
+    'mheap/github-action-required-labels@v5.6.0':
+        ref: 'v5.6.0'
+        commit: 'sha1-23e10fde7e062233401931a0eece796cd9bf3177'
+        owner_id: 59130
+        repo_id: 272521528
+    're-actors/alls-green@v1.3.0':
+        ref: 'v1.3.0'
+        commit: 'sha1-b5b5b37504aa4183270bd3d855c52a67f212be35'
+        owner_id: 46427759
+        repo_id: 434447646
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 07087b836cb597..50b0469867c1a4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -41,13 +41,13 @@ jobs:
     #        || 'falsy-branch'
     #   }}
     #
-    uses: ./.github/workflows/reusable-context.yml
+    uses: $/.github/workflows/reusable-context.yml
 
   check-docs:
     name: Docs
     needs: build-context
     if: fromJSON(needs.build-context.outputs.run-docs)
-    uses: ./.github/workflows/reusable-docs.yml
+    uses: $/.github/workflows/reusable-docs.yml
 
   check-autoconf-regen:
     name: 'Check if Autoconf files are up to date'
@@ -64,7 +64,7 @@ jobs:
         run: |
           apt update && apt install git -yq
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 1
           persist-credentials: false
@@ -101,10 +101,10 @@ jobs:
     needs: build-context
     if: needs.build-context.outputs.run-tests == 'true'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.x'
       - name: Runner image version
@@ -147,7 +147,7 @@ jobs:
     if: >-
       needs.build-context.outputs.run-tests == 'true'
       || needs.build-context.outputs.run-docs == 'true'
-    uses: ./.github/workflows/reusable-check-c-api-docs.yml
+    uses: $/.github/workflows/reusable-check-c-api-docs.yml
 
   build-windows:
     name: >-
@@ -175,7 +175,7 @@ jobs:
           # and only supported on 3.15+.
           - { arch: x64, free-threading: false, interpreter: tail-call }
           - { arch: x64, free-threading: true,  interpreter: tail-call }
-    uses: ./.github/workflows/reusable-windows.yml
+    uses: $/.github/workflows/reusable-windows.yml
     with:
       arch: ${{ matrix.arch }}
       free-threading: ${{ matrix.free-threading }}
@@ -201,7 +201,7 @@ jobs:
         exclude:
         - os: macos-26-intel
           free-threading: true
-    uses: ./.github/workflows/reusable-macos.yml
+    uses: $/.github/workflows/reusable-macos.yml
     with:
       free-threading: ${{ matrix.free-threading }}
       os: ${{ matrix.os }}
@@ -238,7 +238,7 @@ jobs:
           bolt: false
           free-threading: false
           test-opts: '-u cpu'
-    uses: ./.github/workflows/reusable-ubuntu.yml
+    uses: $/.github/workflows/reusable-ubuntu.yml
     with:
       bolt-optimizations: ${{ matrix.bolt }}
       free-threading: ${{ matrix.free-threading }}
@@ -249,7 +249,7 @@ jobs:
     name: 'Ubuntu (installed)'
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
-    uses: ./.github/workflows/reusable-install.yml
+    uses: $/.github/workflows/reusable-install.yml
 
   build-ubuntu-ssltests:
     name: 'Ubuntu SSL tests'
@@ -280,7 +280,7 @@ jobs:
       SSLLIB_DIR: ${{ github.workspace }}/multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }}
       LD_LIBRARY_PATH: ${{ github.workspace }}/multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }}/lib
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
     - name: Runner image version
@@ -291,7 +291,7 @@ jobs:
       run: sudo ./.github/workflows/posix-deps-apt.sh
     - name: 'Restore SSL library build'
       id: cache-ssl-lib
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache@v6.1.0
       with:
         path: ./multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }}
         key: ${{ matrix.os }}-multissl-${{ matrix.ssllib.name }}-${{ matrix.ssllib.version }}
@@ -339,7 +339,7 @@ jobs:
 
     runs-on: ${{ matrix.runs-on }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
       - name: Build and test
@@ -360,7 +360,7 @@ jobs:
         - false
         - true
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
 
@@ -373,13 +373,13 @@ jobs:
     name: 'Emscripten'
     needs: build-context
     if: needs.build-context.outputs.run-emscripten == 'true'
-    uses: ./.github/workflows/reusable-emscripten.yml
+    uses: $/.github/workflows/reusable-emscripten.yml
 
   build-wasi:
     name: 'WASI'
     needs: build-context
     if: needs.build-context.outputs.run-wasi == 'true'
-    uses: ./.github/workflows/reusable-wasi.yml
+    uses: $/.github/workflows/reusable-wasi.yml
 
   test-hypothesis:
     name: "Hypothesis tests on Ubuntu"
@@ -391,7 +391,7 @@ jobs:
       OPENSSL_VER: 3.5.9
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
     - name: Register gcc problem matcher
@@ -405,7 +405,7 @@ jobs:
         echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV"
     - name: 'Restore OpenSSL build'
       id: cache-openssl
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache@v6.1.0
       with:
         path: ./multissl/openssl/${{ env.OPENSSL_VER }}
         key: ${{ runner.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
@@ -452,7 +452,7 @@ jobs:
         ./python -m venv "$VENV_LOC" && "$VENV_PYTHON" -m pip install -r "${GITHUB_WORKSPACE}/Tools/requirements-hypothesis.txt"
     - name: 'Restore Hypothesis database'
       id: cache-hypothesis-database
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache@v6.1.0
       with:
         path: ${{ env.CPYTHON_BUILDDIR }}/.hypothesis/
         key: hypothesis-database-${{ github.head_ref || github.run_id }}
@@ -479,7 +479,7 @@ jobs:
           -x test_subprocess \
           -x test_signal \
           -x test_sysconfig
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@v7.0.1
       if: always()
       with:
         name: hypothesis-example-db
@@ -489,7 +489,7 @@ jobs:
     name: 'Lazy imports enabled'
     needs: build-context
     if: fromJSON(needs.build-context.outputs.run-tests)
-    uses: ./.github/workflows/reusable-test-lazy-imports-all.yml
+    uses: $/.github/workflows/reusable-test-lazy-imports-all.yml
 
   build-san:
     # ${{ '' } is a hack to nest jobs under the same sidebar category.
@@ -516,7 +516,7 @@ jobs:
         - check-name: Memory
           sanitizer: MSan
           free-threading: false
-    uses: ./.github/workflows/reusable-san.yml
+    uses: $/.github/workflows/reusable-san.yml
     with:
       sanitizer: ${{ matrix.sanitizer }}
       free-threading: ${{ matrix.free-threading }}
@@ -528,7 +528,7 @@ jobs:
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
       - name: Runner image version
@@ -598,7 +598,7 @@ jobs:
               && 'no-exclude'
               || 'python3-libraries'
             }}
-    uses: ./.github/workflows/reusable-cifuzz.yml
+    uses: $/.github/workflows/reusable-cifuzz.yml
     with:
       oss-fuzz-project-name: ${{ matrix.oss-fuzz-project-name }}
       sanitizer: ${{ matrix.sanitizer }}
@@ -630,7 +630,7 @@ jobs:
 
     steps:
     - name: Check whether the needed jobs succeeded or failed
-      uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35
+      uses: re-actors/alls-green@v1.3.0
       with:
         allowed-failures: >-
           build-android,
diff --git a/.github/workflows/jit.yml b/.github/workflows/jit.yml
index 381b00185b1ae8..21ecb2c958c12d 100644
--- a/.github/workflows/jit.yml
+++ b/.github/workflows/jit.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
       - name: Install dependencies
@@ -72,10 +72,10 @@ jobs:
             architecture: ARM64
             runner: windows-11-arm
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.11'
       # PCbuild downloads LLVM automatically:
@@ -98,10 +98,10 @@ jobs:
           - true
           - false
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.11'
       - name: Install LLVM
@@ -141,10 +141,10 @@ jobs:
           - target: aarch64-unknown-linux-gnu/gcc
             runner: ubuntu-26.04-arm
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.11'
       - name: Install dependencies
@@ -182,10 +182,10 @@ jobs:
             use_clang: true
             run_tests: false
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.11'
       - name: Install dependencies
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index cd413cd4cfbaa0..0b89ebe92d367d 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -19,7 +19,22 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0
+      - uses: j178/prek-action@v3.0.0
+
+  # Fails when .github/workflows/actions.lock is out of sync with the
+  # workflows or a locked pin no longer verifies upstream.
+  lockfile:
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
+    env:
+      GH_TOKEN: ${{ github.token }}
+
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - run: gh extension install github/gh-actions-lock --pin v0.4.1
+      - run: gh actions-lock --verify
diff --git a/.github/workflows/mypy.yml b/.github/workflows/mypy.yml
index a8c95627c2417d..6109870724ea59 100644
--- a/.github/workflows/mypy.yml
+++ b/.github/workflows/mypy.yml
@@ -66,10 +66,10 @@ jobs:
           "Tools/peg_generator",
         ]
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           python-version: "3.15"
           activate-environment: true
diff --git a/.github/workflows/new-bugs-announce-notifier.yml b/.github/workflows/new-bugs-announce-notifier.yml
index 640474273a9de3..8a1c59f50d8d1d 100644
--- a/.github/workflows/new-bugs-announce-notifier.yml
+++ b/.github/workflows/new-bugs-announce-notifier.yml
@@ -15,12 +15,14 @@ jobs:
       issues: read
     timeout-minutes: 10
     steps:
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@v7.0.0
         with:
           node-version: 20
-      - run: npm install mailgun.js form-data
+      # TODO: Replace with a committed lockfile and `npm ci`, or drop npm
+      # and call the Mailgun REST API from the standard library.
+      - run: npm install mailgun.js form-data # zizmor: ignore[adhoc-packages]
       - name: Send notification
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@v9.0.0
         env:
           MAILGUN_API_KEY: ${{ secrets.MAILGUN_PYTHON_ORG_MAILGUN_KEY }}
         with:
diff --git a/.github/workflows/require-pr-label.yml b/.github/workflows/require-pr-label.yml
index 05c862c5918122..58d223bb34f203 100644
--- a/.github/workflows/require-pr-label.yml
+++ b/.github/workflows/require-pr-label.yml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Check there's no DO-NOT-MERGE
-        uses: mheap/github-action-required-labels@23e10fde7e062233401931a0eece796cd9bf3177 # v5.6.0
+        uses: mheap/github-action-required-labels@v5.6.0
         with:
           mode: exactly
           count: 0
@@ -36,7 +36,7 @@ jobs:
     steps:
       # Check that the PR is not awaiting changes from the author due to previous review.
       - name: Check there's no required changes
-        uses: mheap/github-action-required-labels@23e10fde7e062233401931a0eece796cd9bf3177 # v5.6.0
+        uses: mheap/github-action-required-labels@v5.6.0
         with:
           mode: exactly
           count: 0
@@ -45,7 +45,7 @@ jobs:
             awaiting change review
       - id: is-feature
         name: Check whether this PR is a feature (contains a "type-feature" label)
-        uses: mheap/github-action-required-labels@23e10fde7e062233401931a0eece796cd9bf3177 # v5.6.0
+        uses: mheap/github-action-required-labels@v5.6.0
         with:
           mode: exactly
           count: 1
@@ -56,7 +56,7 @@ jobs:
       - id: awaiting-merge
         if: steps.is-feature.outputs.status == 'success'
         name: Check for complete review
-        uses: mheap/github-action-required-labels@23e10fde7e062233401931a0eece796cd9bf3177 # v5.6.0
+        uses: mheap/github-action-required-labels@v5.6.0
         with:
           mode: exactly
           count: 1
diff --git a/.github/workflows/reusable-check-c-api-docs.yml b/.github/workflows/reusable-check-c-api-docs.yml
index 636c960df4a086..ed4b3f86df4e00 100644
--- a/.github/workflows/reusable-check-c-api-docs.yml
+++ b/.github/workflows/reusable-check-c-api-docs.yml
@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.x'
       - name: Check for undocumented C APIs
diff --git a/.github/workflows/reusable-check-html-ids.yml b/.github/workflows/reusable-check-html-ids.yml
index d07659c96a20b0..bd258ecd971a7a 100644
--- a/.github/workflows/reusable-check-html-ids.yml
+++ b/.github/workflows/reusable-check-html-ids.yml
@@ -16,7 +16,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: 'Check out PR head'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
@@ -43,7 +43,7 @@ jobs:
           MERGE_BASE: ${{ steps.merge-base.outputs.sha }}
         run: git worktree add /tmp/merge-base "$MERGE_BASE" --detach
       - name: 'Set up Python'
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: '3'
           cache: 'pip'
@@ -55,7 +55,7 @@ jobs:
       - name: 'Collect HTML IDs'
         run: python Doc/tools/check-html-ids.py collect /tmp/merge-base/Doc/build/html -o /tmp/html-ids-base.json.gz
       - name: 'Download PR head HTML IDs'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@v8.0.1
         with:
           name: html-ids-head.json.gz
           path: /tmp
diff --git a/.github/workflows/reusable-cifuzz.yml b/.github/workflows/reusable-cifuzz.yml
index a70b75eebc4a98..e14c842d7a8daf 100644
--- a/.github/workflows/reusable-cifuzz.yml
+++ b/.github/workflows/reusable-cifuzz.yml
@@ -37,13 +37,13 @@ jobs:
           sanitizer: ${{ inputs.sanitizer }}
       - name: Upload crash
         if: failure() && steps.build.outcome == 'success'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: ${{ inputs.sanitizer }}-artifacts
           path: ./out/artifacts
       - name: Upload SARIF
         if: always() && steps.build.outcome == 'success'
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@v4.38.2
         with:
           sarif_file: cifuzz-sarif/results.sarif
           checkout_path: cifuzz-sarif
diff --git a/.github/workflows/reusable-context.yml b/.github/workflows/reusable-context.yml
index dedfdb3e552f2f..6c3b454d1a4099 100644
--- a/.github/workflows/reusable-context.yml
+++ b/.github/workflows/reusable-context.yml
@@ -73,14 +73,14 @@ jobs:
       run-windows-tests: ${{ steps.changes.outputs.run-windows-tests }}
     steps:
     - name: Set up Python
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      uses: actions/setup-python@v7.0.0
       with:
         python-version: "3"
 
     - run: >-
         echo '${{ github.event_name }}'
 
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
         ref: >-
diff --git a/.github/workflows/reusable-docs.yml b/.github/workflows/reusable-docs.yml
index e13c43526bc190..b60bdfd302db8f 100644
--- a/.github/workflows/reusable-docs.yml
+++ b/.github/workflows/reusable-docs.yml
@@ -38,7 +38,7 @@ jobs:
       refspec_pr: '+${{ github.event.pull_request.head.sha }}:remotes/origin/${{ github.event.pull_request.head.ref }}'
     steps:
     - name: 'Check out latest PR branch commit'
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
         ref: >-
@@ -63,7 +63,7 @@ jobs:
         git fetch origin "${refspec_base}" --shallow-since="${DATE}" \
           --no-tags --prune --no-recurse-submodules
     - name: 'Set up Python'
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      uses: actions/setup-python@v7.0.0
       with:
         python-version: '3'
         cache: 'pip'
@@ -94,7 +94,7 @@ jobs:
       run: python Doc/tools/check-html-ids.py collect Doc/build/html -o Doc/build/html-ids-head.json.gz
     - name: 'Upload HTML IDs'
       if: github.event_name == 'pull_request'
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@v7.0.1
       with:
         name: html-ids-head
         path: Doc/build/html-ids-head.json.gz
@@ -104,7 +104,7 @@ jobs:
     name: 'Check for removed HTML IDs'
     needs: build-doc
     if: github.event_name == 'pull_request'
-    uses: ./.github/workflows/reusable-check-html-ids.yml
+    uses: $/.github/workflows/reusable-check-html-ids.yml
 
   # Run "doctest" on HEAD as new syntax doesn't exist in the latest stable release
   doctest:
@@ -112,10 +112,10 @@ jobs:
     runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
-    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    - uses: actions/cache@v6.1.0
       with:
         path: ~/.cache/pip
         key: ubuntu-doc-${{ hashFiles('Doc/requirements.txt') }}
@@ -138,11 +138,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
     - name: 'Set up Python'
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      uses: actions/setup-python@v7.0.0
       with:
         python-version: '3'
         cache: 'pip'
diff --git a/.github/workflows/reusable-emscripten.yml b/.github/workflows/reusable-emscripten.yml
index d093c86eb2db96..6565e671420f09 100644
--- a/.github/workflows/reusable-emscripten.yml
+++ b/.github/workflows/reusable-emscripten.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-26.04
     timeout-minutes: 40
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
     - name: "Read Emscripten config"
@@ -41,18 +41,18 @@ jobs:
         with open(os.environ["GITHUB_ENV"], "a") as f:
             f.write(f"PY_EMSDK_CACHE={emsdk_cache}\n")
     - name: "Install Node.js"
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      uses: actions/setup-node@v7.0.0
       with:
         node-version: ${{ steps.emscripten-config.outputs.node-version }}
     - name: "Cache Emscripten SDK"
       id: emsdk-cache
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache@v6.1.0
       with:
         path: ${{ env.PY_EMSDK_CACHE }}
         key: emsdk-${{ steps.emscripten-config.outputs.emscripten-version }}-${{ steps.emscripten-config.outputs.deps-hash }}
         restore-keys: emsdk-${{ steps.emscripten-config.outputs.emscripten-version }}
     - name: "Install Python"
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      uses: actions/setup-python@v7.0.0
       with:
         python-version: '3.x'
     - name: "Runner image version"
diff --git a/.github/workflows/reusable-install.yml b/.github/workflows/reusable-install.yml
index b8acf1a0fb1771..fa09a9a4f34c58 100644
--- a/.github/workflows/reusable-install.yml
+++ b/.github/workflows/reusable-install.yml
@@ -17,7 +17,7 @@ jobs:
     env:
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
     - name: Register gcc problem matcher
diff --git a/.github/workflows/reusable-macos.yml b/.github/workflows/reusable-macos.yml
index 2883a20b612f85..ec9fd64b282aa1 100644
--- a/.github/workflows/reusable-macos.yml
+++ b/.github/workflows/reusable-macos.yml
@@ -31,7 +31,7 @@ jobs:
       PYTHONSTRICTEXTENSIONBUILD: 1
       TERM: linux
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
     - name: Runner image version
diff --git a/.github/workflows/reusable-san.yml b/.github/workflows/reusable-san.yml
index 9c31241498a75e..fb7d84e889e118 100644
--- a/.github/workflows/reusable-san.yml
+++ b/.github/workflows/reusable-san.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
     - name: Runner image version
@@ -100,7 +100,7 @@ jobs:
     - name: 'Restore OpenSSL build'
       id: cache-openssl
       if: inputs.sanitizer == 'TSan' || inputs.sanitizer == 'ASan'
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache@v6.1.0
       with:
         path: ./multissl/openssl/${{ env.OPENSSL_VER }}
         key: >-
@@ -163,7 +163,7 @@ jobs:
       run: find "${GITHUB_WORKSPACE}" -name 'san_log.*' | xargs head -n 1000
     - name: Archive logs
       if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@v7.0.1
       with:
         name: >-
           ${{ inputs.sanitizer }}-logs-${{
diff --git a/.github/workflows/reusable-test-lazy-imports-all.yml b/.github/workflows/reusable-test-lazy-imports-all.yml
index b30a776f1a9858..ea2615b880558b 100644
--- a/.github/workflows/reusable-test-lazy-imports-all.yml
+++ b/.github/workflows/reusable-test-lazy-imports-all.yml
@@ -26,7 +26,7 @@ jobs:
     env:
       EXCLUDE_FILE: Lib/test/lazy_imports_all_exclude.txt
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
     - name: Register gcc problem matcher
diff --git a/.github/workflows/reusable-ubuntu.yml b/.github/workflows/reusable-ubuntu.yml
index 1b10078b8409f4..f6e42e1861349c 100644
--- a/.github/workflows/reusable-ubuntu.yml
+++ b/.github/workflows/reusable-ubuntu.yml
@@ -39,7 +39,7 @@ jobs:
       PYTHONSTRICTEXTENSIONBUILD: 1
       TERM: linux
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
     - name: Register gcc problem matcher
@@ -59,7 +59,7 @@ jobs:
         echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV"
     - name: 'Restore OpenSSL build'
       id: cache-openssl
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache@v6.1.0
       with:
         path: ./multissl/openssl/${{ env.OPENSSL_VER }}
         key: ${{ inputs.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
diff --git a/.github/workflows/reusable-wasi.yml b/.github/workflows/reusable-wasi.yml
index 5b2fda1fe4f82d..d4d51fbd1f3029 100644
--- a/.github/workflows/reusable-wasi.yml
+++ b/.github/workflows/reusable-wasi.yml
@@ -17,12 +17,12 @@ jobs:
     env:
       WASMTIME_VERSION: 48.0.2
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
     # No problem resolver registered as one doesn't currently exist for Clang.
     - name: "Install wasmtime"
-      uses: bytecodealliance/actions/wasmtime/setup@9152e710e9f7182e4c29ad218e4f335a7b203613 # v1.1.3
+      uses: bytecodealliance/actions/wasmtime/setup@v1.1.3
       with:
         version: ${{ env.WASMTIME_VERSION }}
     - name: "Read WASI SDK version"
@@ -38,12 +38,12 @@ jobs:
       shell: python
     - name: "Install WASI SDK"
       id: install-wasi-sdk
-      uses: bytecodealliance/setup-wasi-sdk-action@77d09f3df1e8da344d8403cf8631af8977938b4c
+      uses: bytecodealliance/setup-wasi-sdk-action@v1.0.0
       with:
         version: ${{ steps.wasi-sdk-version.outputs.version }}
         add-to-path: false
     - name: "Install Python"
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      uses: actions/setup-python@v7.0.0
       with:
         python-version: '3.x'
     - name: "Runner image version"
diff --git a/.github/workflows/reusable-windows.yml b/.github/workflows/reusable-windows.yml
index 4be4bc05fa6d0d..eb6c22f2c4cf43 100644
--- a/.github/workflows/reusable-windows.yml
+++ b/.github/workflows/reusable-windows.yml
@@ -31,7 +31,7 @@ jobs:
     env:
       ARCH: ${{ inputs.arch }}
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
     - name: Register MSVC problem matcher
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index c6094947cf98f6..4b528a6f986177 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
     - name: "Check PRs"
-      uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+      uses: actions/stale@v11.0.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-pr-message: 'This PR is stale because it has been open for 90 days with no activity.'
diff --git a/.github/workflows/tail-call.yml b/.github/workflows/tail-call.yml
index 1dc5ea1bc51356..c302f543a8fd74 100644
--- a/.github/workflows/tail-call.yml
+++ b/.github/workflows/tail-call.yml
@@ -41,10 +41,10 @@ jobs:
             runner: ubuntu-26.04-arm
             configure_flags: --with-pydebug
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.11'
       - name: Build
diff --git a/.github/workflows/verify-ensurepip-wheels.yml b/.github/workflows/verify-ensurepip-wheels.yml
index 4d0c5d21d5def2..89083b65d71bfa 100644
--- a/.github/workflows/verify-ensurepip-wheels.yml
+++ b/.github/workflows/verify-ensurepip-wheels.yml
@@ -25,10 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@v7.0.0
         with:
           python-version: '3'
       - name: Compare checksum of bundled wheels to the ones published on PyPI
diff --git a/.github/workflows/verify-expat.yml b/.github/workflows/verify-expat.yml
index 7a1046059e0ba8..ce1ae0ee8a77fc 100644
--- a/.github/workflows/verify-expat.yml
+++ b/.github/workflows/verify-expat.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
       - name: Download and verify bundled libexpat files
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 45528d9f32d6c9..bda616bad11c54 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 3b3f7c3f57fe9925356faf5fe6230835138be230  # frozen: v0.15.17
+    rev: c0f278f1254ccc8fb09676bcdb8d847e7db493e5  # frozen: v0.17.4
     hooks:
       - id: ruff-check
         name: Run Ruff (lint) on Platforms/Apple/
@@ -70,7 +70,7 @@ repos:
         files: ^Tools/wasm/
 
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: ea488cebbfd88a5f50b8bd95d5c829d0bb76feb8  # frozen: 26.1.0
+    rev: a5439e9af2ff9371297bb1a76a01b8ad17989b88  # frozen: 26.10.1
     hooks:
       - id: black
         name: Run Black on Tools/jit/
@@ -104,7 +104,7 @@ repos:
         files: '^\.github/CODEOWNERS|\.(gram)$'
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 9f48a48aa91a6040d749ad68ec70907d907a5a7f  # frozen: 0.37.0
+    rev: a76b92851fc9eede9f9bc4073eb55202f34eb0df  # frozen: 0.39.0
     hooks:
       - id: check-dependabot
       - id: check-github-workflows
@@ -116,7 +116,7 @@ repos:
       - id: actionlint
 
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
-    rev: b546b77c44c466a54a42af5499dcc0dcc1a3193f  # frozen: v1.22.0
+    rev: 06a39750ec31860bb44f2acf67182c40016cd1e7  # frozen: v1.32.0
     hooks:
       - id: zizmor