diff --git a/.github/workflows/cargo-vet-refresh.yml b/.github/workflows/cargo-vet-refresh.yml
index 2df50ac66..fc209deb3 100644
--- a/.github/workflows/cargo-vet-refresh.yml
+++ b/.github/workflows/cargo-vet-refresh.yml
@@ -113,7 +113,7 @@ jobs:
         run: rustup show
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           # Unique suffix so this workflow's cache doesn't evict the
           # main CI cache (and vice versa).  cargo-vet's compile is
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7143bf960..10d60f027 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -138,7 +138,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: ${{ matrix.language }}
           # Rust support (public preview) currently only accepts
@@ -153,6 +153,6 @@ jobs:
           # queries: security-and-quality
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/crates-io-dry-run.yml b/.github/workflows/crates-io-dry-run.yml
index 195996b63..ec038ac1b 100644
--- a/.github/workflows/crates-io-dry-run.yml
+++ b/.github/workflows/crates-io-dry-run.yml
@@ -158,7 +158,7 @@ jobs:
         run: rustup show
 
       - name: Cache cargo dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           # Dedicated cache key — dry-run's compile output is small
           # (per-crate package verifications) and disjoint from the
diff --git a/.github/workflows/nightly-canary.yml b/.github/workflows/nightly-canary.yml
index eb602eb22..199aed8a5 100644
--- a/.github/workflows/nightly-canary.yml
+++ b/.github/workflows/nightly-canary.yml
@@ -129,7 +129,7 @@ jobs:
           cargo +nightly clippy --version
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           # Per-OS, per-canary cache key.  Distinct from the pinned-
           # toolchain caches so a floating-nightly artifact set never
diff --git a/.github/workflows/pr-fast.yml b/.github/workflows/pr-fast.yml
index 18a03f84f..1f4223195 100644
--- a/.github/workflows/pr-fast.yml
+++ b/.github/workflows/pr-fast.yml
@@ -230,7 +230,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - run: rustup show
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: pr-fast-sanity
           save-if: 'false'
@@ -256,7 +256,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - run: rustup show
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: pr-fast-sanity
           save-if: 'false'
@@ -280,7 +280,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - run: rustup show
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: pr-fast-sanity
           save-if: 'false'
@@ -309,7 +309,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - run: rustup show
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: pr-fast-sanity
           save-if: 'false'
@@ -368,7 +368,7 @@ jobs:
           df -h /
 
       - run: rustup show
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: pr-fast-sanity
           cache-on-failure: 'true'
@@ -410,7 +410,7 @@ jobs:
           df -h /
 
       - run: rustup show
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: pr-fast-sanity
           save-if: 'false'
@@ -442,7 +442,7 @@ jobs:
           df -h /
 
       - run: rustup show
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: pr-fast-clippy-no-default
           save-if: 'false'
@@ -474,7 +474,7 @@ jobs:
           df -h /
 
       - run: rustup show
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: pr-fast-sanity
           save-if: 'false'
@@ -511,7 +511,7 @@ jobs:
           df -h /
 
       - run: rustup show
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: pr-fast-test-build
           cache-on-failure: 'true'
@@ -548,7 +548,7 @@ jobs:
           df -h /
 
       - run: rustup show
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: pr-fast-test-build
           save-if: 'false'
@@ -589,7 +589,7 @@ jobs:
           fetch-depth: 0
 
       - run: rustup show
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: pr-fast-security
 
@@ -672,7 +672,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - run: rustup show
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: pr-fast-windows
 
diff --git a/.github/workflows/preview-artifacts.yml b/.github/workflows/preview-artifacts.yml
index b9a5659de..ab705bc4a 100644
--- a/.github/workflows/preview-artifacts.yml
+++ b/.github/workflows/preview-artifacts.yml
@@ -174,7 +174,7 @@ jobs:
         with:
           tool: cargo-xwin
 
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: preview-windows
 
@@ -265,7 +265,7 @@ jobs:
         with:
           tool: nextest
 
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: preview-test-archive-windows
 
diff --git a/.github/workflows/release-cache-warm.yml b/.github/workflows/release-cache-warm.yml
index daef1e983..3b51d9bfb 100644
--- a/.github/workflows/release-cache-warm.yml
+++ b/.github/workflows/release-cache-warm.yml
@@ -183,7 +183,7 @@ jobs:
           rustc --version
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           # MUST match `release.yml::build-release-binaries`'s shared-key
           # exactly so this workflow's saves are reachable from
diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index 9311160c3..e4627c08e 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -363,7 +363,7 @@ jobs:
         run: rustup show
 
       - name: Cache cargo dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           # Dedicated cache key — separate from R3 shadow cache so
           # the cache effects of active mode (which compiles different
@@ -421,7 +421,7 @@ jobs:
         run: rustup show
 
       - name: Cache cargo dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: release-plz-active-release
 
@@ -526,7 +526,7 @@ jobs:
         uses: dtolnay/rust-toolchain@nightly
 
       - name: Cache cargo dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: crates-io-publish
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8ca745695..18efcf12d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -429,7 +429,7 @@ jobs:
           rustc --version
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           # `shared-key:` (not `key:`) so the action's built-in fallback
           # restores partial matches when `Cargo.lock` shifts between
@@ -1057,7 +1057,7 @@ jobs:
         # someone with `contents: write` silently swaps a binary, the
         # SHA256 in the attestation won't match and `gh attestation
         # verify` fails).
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: "final-release/*"
 
diff --git a/.github/workflows/tier-2.yml b/.github/workflows/tier-2.yml
index 3cbd86729..19da3efa2 100644
--- a/.github/workflows/tier-2.yml
+++ b/.github/workflows/tier-2.yml
@@ -81,7 +81,7 @@ jobs:
         run: rustup show
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: tier-2-coverage
           cache-on-failure: 'true'
@@ -145,7 +145,7 @@ jobs:
         run: rustup show
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: tier-2-build-validation
           cache-on-failure: 'true'
@@ -186,7 +186,7 @@ jobs:
         run: rustup show
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: tier-2-udeps
           cache-on-failure: 'true'
@@ -261,7 +261,7 @@ jobs:
         run: rustup show
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: tier-2-hack
           cache-on-failure: 'true'
@@ -311,7 +311,7 @@ jobs:
         run: rustup show
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: tier-2-miri
           cache-on-failure: 'true'
@@ -398,7 +398,7 @@ jobs:
         run: rustup show
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           # Dedicated cache key — cargo-careful's `-Zbuild-std`
           # rebuild produces a distinct sysroot / target-dir layout
@@ -519,7 +519,7 @@ jobs:
         run: rustup show
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           # Dedicated cache key — cargo-mutants does many short
           # per-mutant rebuilds and benefits from its own cache so
@@ -672,7 +672,7 @@ jobs:
         run: rustup show
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           # Dedicated cache key — the fuzz crate has its own
           # `[workspace] members = ["."]` and a separate target-dir