diff --git a/.github/workflows/android-fdroid.yml b/.github/workflows/android-fdroid.yml
index 080d6f5..be8e011 100644
--- a/.github/workflows/android-fdroid.yml
+++ b/.github/workflows/android-fdroid.yml
@@ -71,7 +71,7 @@ jobs:
     outputs:
       apk: ${{ steps.raus.outputs.apk }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           path: quelle
@@ -216,7 +216,7 @@ jobs:
           done
           echo "APK gesamt: $(stat -c %s "aus/$APK") Byte" >> "$GITHUB_STEP_SUMMARY"
 
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.lauf == 'erster' && 'android-unsigniert' || 'android-gegenprobe' }}
           path: ${{ github.workspace }}/aus/
@@ -229,7 +229,7 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: android-unsigniert
           path: aus
@@ -255,7 +255,7 @@ jobs:
         env:
           APK: ${{ steps.pruefen.outputs.apk }}
         run: sha256sum -c "$APK.sha256"
-      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: aus/${{ steps.pruefen.outputs.apk }}
 
@@ -271,15 +271,15 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: secure-messenger/fdroid
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: android-unsigniert
           path: erster
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: android-gegenprobe
           path: zweiter
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4e7cace..d322cbd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,10 +29,10 @@ jobs:
       run:
         working-directory: secure-messenger/app
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
       - name: Relay-Abhaengigkeiten (die Tests starten echte Server)
@@ -55,10 +55,10 @@ jobs:
       run:
         working-directory: secure-messenger/server
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
       - name: libsodium fuer XEdDSA
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index db641b7..da635e7 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -30,11 +30,11 @@ jobs:
       matrix:
         language: [python, actions]
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           languages: ${{ matrix.language }}
           queries: security-extended
-      - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+      - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 1705745..43146f2 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -33,7 +33,7 @@ jobs:
     outputs:
       paket: ${{ steps.schnueren.outputs.paket }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Werkzeuge fuer den Linux-Bau
@@ -61,7 +61,7 @@ jobs:
           tar -C build/linux/x64/release/bundle -czf "$GITHUB_WORKSPACE/aus/$PAKET" .
           (cd "$GITHUB_WORKSPACE/aus" && sha256sum "$PAKET" | tee "$PAKET.sha256")
           echo "paket=$PAKET" >> "$GITHUB_OUTPUT"
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: linux-paket
           path: ${{ github.workspace }}/aus/
@@ -76,7 +76,7 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: linux-paket
           path: aus
@@ -118,7 +118,7 @@ jobs:
         env:
           PAKET: ${{ steps.pruefen.outputs.paket }}
         run: sha256sum -c "$PAKET.sha256"
-      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: aus/${{ steps.pruefen.outputs.paket }}
       - name: An den Release haengen
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 29a0e75..26b0be7 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -21,14 +21,14 @@ jobs:
       security-events: write
       id-token: write
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+      - uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
-      - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+      - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/security-txt.yml b/.github/workflows/security-txt.yml
index 04b4087..ecdd445 100644
--- a/.github/workflows/security-txt.yml
+++ b/.github/workflows/security-txt.yml
@@ -19,7 +19,7 @@ jobs:
   ablauf:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Ablaufdatum pruefen
diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml
index 20dd47b..46a3ea7 100644
--- a/.github/workflows/snyk.yml
+++ b/.github/workflows/snyk.yml
@@ -64,14 +64,14 @@ jobs:
     env:
       SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       # Snyk liest die INSTALLIERTEN Pakete, darum dieselbe Fassung wie auf dem
       # Server (3.10, siehe sonar-project.properties). Mit 3.12 fehlten
       # exceptiongroup und tomli (nur < 3.11), und Snyk brach mit
       # SNYK-OS-PYTHON-0013 ab (erster Lauf 18.10.2026).
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.10'
       - name: libsodium fuer XEdDSA
@@ -117,13 +117,13 @@ jobs:
 
       - name: Relay-Ergebnis hochladen
         if: always() && hashFiles('snyk-relay.sarif') != ''
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           sarif_file: snyk-relay.sarif
           category: snyk-relay
       - name: Code-Ergebnis hochladen
         if: always() && hashFiles('snyk-code.sarif') != ''
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           sarif_file: snyk-code.sarif
           category: snyk-code
diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
index 41318d7..2083270 100644
--- a/.github/workflows/sonar.yml
+++ b/.github/workflows/sonar.yml
@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Die ganze Geschichte: Sonar ordnet Befunde ueber git blame neuem
           # oder altem Code zu und kommentiert Pull-Requests nur mit ihr.