diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1ac96b0..f03b6c2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,16 +30,16 @@ jobs:
         with:
           fetch-depth: 0 # needs-release/calver read tags and history
       - id: gate
-        uses: metio/ci/needs-release@59a3cbf82e2797f72e63edce1880a4c8db865a3d # 2026.7.6091618
+        uses: metio/ci/needs-release@aec58ab29b70164cbb45864d38e4122fe4bfd59f # 2026.7.9215937
         with:
           paths: action.yml
       - id: version
         if: steps.gate.outputs.needed == 'true'
-        uses: metio/ci/calver@59a3cbf82e2797f72e63edce1880a4c8db865a3d # 2026.7.6091618
+        uses: metio/ci/calver@aec58ab29b70164cbb45864d38e4122fe4bfd59f # 2026.7.9215937
       - id: notes
         name: Generate release notes
         if: steps.gate.outputs.needed == 'true'
-        uses: metio/ci/release-notes@59a3cbf82e2797f72e63edce1880a4c8db865a3d # 2026.7.6091618
+        uses: metio/ci/release-notes@aec58ab29b70164cbb45864d38e4122fe4bfd59f # 2026.7.9215937
         with:
           version: ${{ steps.version.outputs.version }}
           previous: ${{ steps.gate.outputs.last }}
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 5d9a76a..9382195 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -46,7 +46,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: metio/ci/policy-check@59a3cbf82e2797f72e63edce1880a4c8db865a3d # 2026.7.6091618
+      - uses: metio/ci/policy-check@aec58ab29b70164cbb45864d38e4122fe4bfd59f # 2026.7.9215937
   verify:
     # Single required check: mark only this one required in branch protection and
     # new jobs are covered automatically.