diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 26de939..f07bdc0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,16 +30,16 @@ jobs:
         with:
           fetch-depth: 0 # needs-release/calver read tags and history
       - id: gate
-        uses: metio/ci/needs-release@5471b4a64164b3e2cb6eecbe911e3caaf7a22542 # 2026.9.18095708
+        uses: metio/ci/needs-release@46616c49a31480c95fe6e3b2229f264645d28763 # 2026.9.19094139
         with:
           paths: action.yml
       - id: version
         if: steps.gate.outputs.needed == 'true'
-        uses: metio/ci/calver@5471b4a64164b3e2cb6eecbe911e3caaf7a22542 # 2026.9.18095708
+        uses: metio/ci/calver@46616c49a31480c95fe6e3b2229f264645d28763 # 2026.9.19094139
       - id: notes
         name: Generate release notes
         if: steps.gate.outputs.needed == 'true'
-        uses: metio/ci/release-notes@5471b4a64164b3e2cb6eecbe911e3caaf7a22542 # 2026.9.18095708
+        uses: metio/ci/release-notes@46616c49a31480c95fe6e3b2229f264645d28763 # 2026.9.19094139
         with:
           version: ${{ steps.version.outputs.version }}
           previous: ${{ steps.gate.outputs.last }}
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 5fcbbf3..1c9f950 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -46,7 +46,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: metio/ci/policy-check@5471b4a64164b3e2cb6eecbe911e3caaf7a22542 # 2026.9.18095708
+      - uses: metio/ci/policy-check@46616c49a31480c95fe6e3b2229f264645d28763 # 2026.9.19094139
   dco:
     # Developer Certificate of Origin: every commit carries a Signed-off-by
     # trailer. Bot PRs skip; a skipped job still satisfies the gate below.
@@ -57,7 +57,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - uses: metio/ci/dco@5471b4a64164b3e2cb6eecbe911e3caaf7a22542 # main
+      - uses: metio/ci/dco@46616c49a31480c95fe6e3b2229f264645d28763 # main
   verify:
     # Single required check: mark only this one required in branch protection and
     # new jobs are covered automatically.