diff --git a/.github/workflows/azure-migration-tests.yml b/.github/workflows/azure-migration-tests.yml
index 5d9eb3b9e76..4003ea131d9 100644
--- a/.github/workflows/azure-migration-tests.yml
+++ b/.github/workflows/azure-migration-tests.yml
@@ -127,7 +127,7 @@ jobs:
           Install-Module @splatPesterInstall
 
       - name: Authenticate existing Azure CI identity
-        uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
         with:
           creds: ${{ secrets.VMSS_AZURE_CREDENTIALS }}
 
diff --git a/.github/workflows/ci-azure-supersede.yml b/.github/workflows/ci-azure-supersede.yml
index c2aaae857c7..25bfa776c7b 100644
--- a/.github/workflows/ci-azure-supersede.yml
+++ b/.github/workflows/ci-azure-supersede.yml
@@ -33,7 +33,8 @@ concurrency:
 jobs:
   supersede:
     # Fork PRs get a read-only token that cannot cancel runs; their lanes keep FIFO.
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    # Dependabot PRs never start a ci-azure run, so there is nothing to supersede.
+    if: github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
diff --git a/.github/workflows/ci-azure.yml b/.github/workflows/ci-azure.yml
index 41e5a651068..b1016297e1a 100644
--- a/.github/workflows/ci-azure.yml
+++ b/.github/workflows/ci-azure.yml
@@ -74,6 +74,11 @@ env:
 
 jobs:
   authorize:
+    # Dependabot only ever bumps action pins, and its runs get no repository secrets.
+    # Every job below depends on authorize, so skipping it here keeps the whole matrix
+    # off the Azure runner pools. azure-migration-tests already skips the same way; the
+    # earlier attempts at this only patched that file, which is why it kept firing.
+    if: github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
     timeout-minutes: 2
     outputs:
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 82bad13199d..efe57c6eb16 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -94,7 +94,7 @@ jobs:
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a # v1
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           prompt: |
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index aa5685f77f2..df06cd03513 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -88,7 +88,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a # v1
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
diff --git a/.github/workflows/ps3-smoke.yml b/.github/workflows/ps3-smoke.yml
index e12c6b0992c..bfa3839e708 100644
--- a/.github/workflows/ps3-smoke.yml
+++ b/.github/workflows/ps3-smoke.yml
@@ -32,7 +32,7 @@ jobs:
     timeout-minutes: 55
     steps:
       - name: Azure login (OIDC)
-        uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
         with:
           client-id: ${{ vars.AZURE_CLIENT_ID }}
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
diff --git a/.github/workflows/runner-reconcile.yml b/.github/workflows/runner-reconcile.yml
index 3ef1a99771a..2693e974aa8 100644
--- a/.github/workflows/runner-reconcile.yml
+++ b/.github/workflows/runner-reconcile.yml
@@ -86,7 +86,7 @@ jobs:
       BOOTSTRAP_PATH: /tmp/bootstrap-runner.ps1
     steps:
       - name: Azure login (OIDC)
-        uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
         with:
           client-id: ${{ vars.AZURE_CLIENT_ID }}
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -136,7 +136,7 @@ jobs:
       contents: read
     steps:
       - name: Azure login (OIDC)
-        uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
         with:
           client-id: ${{ vars.AZURE_CLIENT_ID }}
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
diff --git a/.github/workflows/runner-scale-up.yml b/.github/workflows/runner-scale-up.yml
index 2b8ef8cfff2..8b8ef59ab87 100644
--- a/.github/workflows/runner-scale-up.yml
+++ b/.github/workflows/runner-scale-up.yml
@@ -61,7 +61,7 @@ jobs:
       BOOTSTRAP_PATH: /tmp/bootstrap-runner.ps1
     steps:
       - name: Azure login (OIDC)
-        uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
         with:
           client-id: ${{ vars.AZURE_CLIENT_ID }}
           tenant-id: ${{ vars.AZURE_TENANT_ID }}