diff --git a/.github/workflows/label-pr.yml b/.github/workflows/label-pr.yml
index 684baa71..3289e801 100644
--- a/.github/workflows/label-pr.yml
+++ b/.github/workflows/label-pr.yml
@@ -1,6 +1,6 @@
 name: Set / Validate PR Labels
 on:
-  pull_request_target:
+  pull_request:
     branches:
     - main
     types:
@@ -22,8 +22,9 @@ jobs:
     name: Ensure Minimal Semver Labels
     runs-on: ubuntu-24.04
     permissions:
-      issues: read # read the issue's current labels
-      pull-requests: read # read the pull request's metadata
+      contents: read # check out the repository to determine which files changed
+      issues: write # add the semver label
+      pull-requests: write # update the pull request's labels
     steps:
     - name: Check Minimal Semver Labels
       uses: mheap/github-action-required-labels@23e10fde7e062233401931a0eece796cd9bf3177 # v5.6.0
@@ -35,7 +36,9 @@ jobs:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Auto-label Semver
-      if: ${{ failure() }}
+      # Pull requests from forks receive a read-only token, so they cannot be
+      # auto-labeled. A maintainer must add the label to those pull requests.
+      if: ${{ failure() && github.event.pull_request.head.repo.full_name == github.repository }}
       uses: paketo-buildpacks/github-config/actions/pull-request/auto-semver-label@main
       env:
-        GITHUB_TOKEN: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/push-buildpackage.yml b/.github/workflows/push-buildpackage.yml
index a0a93511..b952a27d 100644
--- a/.github/workflows/push-buildpackage.yml
+++ b/.github/workflows/push-buildpackage.yml
@@ -73,7 +73,7 @@ jobs:
         echo "push_to_gcr=${push_to_gcr}" >> "$GITHUB_OUTPUT"
 
     - name: Install yj and crane
-      uses: buildpacks/github-actions/setup-tools@af8c06ccd592e27001cbf78083dcc9b47aa6652a # v6.1.1
+      uses: buildpacks/github-actions/setup-tools@50b58314ff7858c48496a3fee25308c8a18eae79 # v6.2.3
 
     - name: Validate version
       env:
@@ -87,14 +87,14 @@ jobs:
         fi
 
     - name: Docker login docker.io
-      uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
       with:
         username: ${{ env.DOCKERHUB_USERNAME }}
         password: ${{ env.DOCKERHUB_PASSWORD }}
         registry: ${{ env.DOCKERHUB_REGISTRY }}
 
     - name: Docker login gcr.io
-      uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
       if: ${{ steps.parse_configs.outputs.push_to_gcr == 'true' }}
       with:
         username: ${{ env.GCR_USERNAME }}
diff --git a/scripts/.util/tools.json b/scripts/.util/tools.json
index 4112bd84..daf6ac84 100644
--- a/scripts/.util/tools.json
+++ b/scripts/.util/tools.json
@@ -1,7 +1,7 @@
 {
   "createpackage": "v1.73.0",
-  "jam": "v2.18.0",
-  "libpaktools": "v0.6.0",
-  "pack": "v0.40.9",
+  "jam": "v2.19.1",
+  "libpaktools": "v0.8.0",
+  "pack": "v0.40.10",
   "yj": "v5.1.0"
 }