diff --git a/pkg/workflow/action_pins_test.go b/pkg/workflow/action_pins_test.go
index 66ccafcc78..9cbe8948a9 100644
--- a/pkg/workflow/action_pins_test.go
+++ b/pkg/workflow/action_pins_test.go
@@ -297,9 +297,9 @@ func TestApplyActionPinToStep(t *testing.T) {
 func TestGetActionPinsSorting(t *testing.T) {
 	pins := getActionPins()
 
-	// Verify we got all the pins (43 as of February 2026)
-	if len(pins) != 43 {
-		t.Errorf("getActionPins() returned %d pins, expected 43", len(pins))
+	// Verify we got all the pins (38 as of February 2026)
+	if len(pins) != 38 {
+		t.Errorf("getActionPins() returned %d pins, expected 38", len(pins))
 	}
 
 	// Verify they are sorted by version (descending) then by repository name (ascending)
@@ -339,13 +339,13 @@ func TestGetActionPinByRepo(t *testing.T) {
 			repo:         "actions/checkout",
 			expectExists: true,
 			expectRepo:   "actions/checkout",
-			expectVer:    "v6",
+			expectVer:    "v6.0.2",
 		},
 		{
 			repo:         "actions/setup-node",
 			expectExists: true,
 			expectRepo:   "actions/setup-node",
-			expectVer:    "v6.1.0",
+			expectVer:    "v6.2.0",
 		},
 		{
 			repo:         "unknown/action",
@@ -542,14 +542,14 @@ func TestGetActionPinSemverPreference(t *testing.T) {
 		expectedVersion string
 	}{
 		{
-			name:            "setup-go prefers v6.1.0 over v6",
+			name:            "setup-go prefers v6.2.0 over v6",
 			repo:            "actions/setup-go",
-			expectedVersion: "v6.1.0",
+			expectedVersion: "v6.2.0",
 		},
 		{
-			name:            "setup-node prefers v6.1.0 over v6",
+			name:            "setup-node prefers v6.2.0 over v6",
 			repo:            "actions/setup-node",
-			expectedVersion: "v6.1.0",
+			expectedVersion: "v6.2.0",
 		},
 		{
 			name:            "upload-artifact prefers v6.0.0 over v5 and v4",
@@ -601,18 +601,18 @@ func TestGetActionPinWithData_SemverPreference(t *testing.T) {
 		shouldFallback bool // Whether we expect to fall back to highest version
 	}{
 		{
-			name:           "exact match for setup-go v6.1.0",
+			name:           "exact match for setup-go v6.2.0",
 			repo:           "actions/setup-go",
-			requestedVer:   "v6.1.0",
-			expectedVer:    "v6.1.0",
+			requestedVer:   "v6.2.0",
+			expectedVer:    "v6.2.0",
 			strictMode:     false,
 			shouldFallback: false,
 		},
 		{
-			name:           "exact match for setup-go v6 from hardcoded pins",
+			name:           "exact match for setup-go v6.2.0 from hardcoded pins",
 			repo:           "actions/setup-go",
-			requestedVer:   "v6",
-			expectedVer:    "v6", // Should match exactly v6, not v6.1.0
+			requestedVer:   "v6.2.0",
+			expectedVer:    "v6.2.0", // Should match exactly v6.2.0
 			strictMode:     false,
 			shouldFallback: false,
 		},
diff --git a/pkg/workflow/data/action_pins.json b/pkg/workflow/data/action_pins.json
index bfb61c7700..c9ea38685d 100644
--- a/pkg/workflow/data/action_pins.json
+++ b/pkg/workflow/data/action_pins.json
@@ -155,6 +155,11 @@
       "version": "v3.32.2",
       "sha": "46a5d05688af3c0b623936fd3365ef1ae945c1cd"
     },
+    "github/stale-repos@v3": {
+      "repo": "github/stale-repos",
+      "version": "v3",
+      "sha": "3477b6488008d9411aaf22a0924ec7c1f6a69980"
+    },
     "github/stale-repos@v3.0.2": {
       "repo": "github/stale-repos",
       "version": "v3.0.2",
@@ -175,6 +180,11 @@
       "version": "v1.288.0",
       "sha": "09a7688d3b55cf0e976497ff046b70949eeaccfd"
     },
+    "super-linter/super-linter@v8.2.1": {
+      "repo": "super-linter/super-linter",
+      "version": "v8.2.1",
+      "sha": "2bdd90ed3262e023ac84bf8fe35dc480721fc1f2"
+    },
     "super-linter/super-linter@v8.5.0": {
       "repo": "super-linter/super-linter",
       "version": "v8.5.0",
diff --git a/pkg/workflow/runtime_setup_test.go b/pkg/workflow/runtime_setup_test.go
index dd777793f1..f4cc9b0c64 100644
--- a/pkg/workflow/runtime_setup_test.go
+++ b/pkg/workflow/runtime_setup_test.go
@@ -284,7 +284,7 @@ func TestGenerateRuntimeSetupSteps(t *testing.T) {
 			expectSteps: 1,
 			checkContent: []string{
 				"Setup Bun",
-				"oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76",
+				"oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3",
 				"bun-version: '1.1'",
 			},
 		},
@@ -296,7 +296,7 @@ func TestGenerateRuntimeSetupSteps(t *testing.T) {
 			expectSteps: 1,
 			checkContent: []string{
 				"Setup Node.js",
-				"actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f",
+				"actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238",
 				"node-version: '20'",
 			},
 		},
@@ -368,7 +368,7 @@ func TestGenerateRuntimeSetupSteps(t *testing.T) {
 			expectSteps: 1,
 			checkContent: []string{
 				"Setup Haskell",
-				"haskell-actions/setup@55073cbd0e96181a9abd6ff4e7d289867dffc98d",
+				"haskell-actions/setup@9cd1b7bf3f36d5a3c3b17abc3545bfb5481912ea",
 				"ghc-version: '9.10'",
 			},
 		},
@@ -402,7 +402,7 @@ func TestGenerateRuntimeSetupSteps(t *testing.T) {
 			expectSteps: 2, // setup + GOROOT capture for AWF chroot mode
 			checkContent: []string{
 				"Setup Go",
-				"actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c",
+				"actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5",
 				"go-version: '1.22'",
 				"Capture GOROOT for AWF chroot mode",
 			},
@@ -415,7 +415,7 @@ func TestGenerateRuntimeSetupSteps(t *testing.T) {
 			expectSteps: 2, // setup + GOROOT capture for AWF chroot mode
 			checkContent: []string{
 				"Setup Go",
-				"actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c",
+				"actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5",
 				"go-version: '1.25'",
 				"Capture GOROOT for AWF chroot mode",
 			},
@@ -428,7 +428,7 @@ func TestGenerateRuntimeSetupSteps(t *testing.T) {
 			expectSteps: 2, // setup + GOROOT capture for AWF chroot mode
 			checkContent: []string{
 				"Setup Go",
-				"actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c",
+				"actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5",
 				"go-version-file: custom/go.mod",
 				"cache: true",
 				"Capture GOROOT for AWF chroot mode",