diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index ae14b8c..92df8f5 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -30,7 +30,7 @@ jobs:
       statuses: write  # Required to publish the CLA commit status.
     steps:
       - name: Check CLA
-        uses: conda/actions/check-cla@7f6830b1428a9bd47f0b068892c77eae95207037 # v26.1.0
+        uses: conda/actions/check-cla@d88418cd4e36358ba51e7c88f2d2d5edb9ac49e7 # v26.8.1
         with:
           # [required]
           # A token with ability to comment, label, and modify the commit status
diff --git a/.github/workflows/issues.yml b/.github/workflows/issues.yml
index be1e1e7..edfb603 100644
--- a/.github/workflows/issues.yml
+++ b/.github/workflows/issues.yml
@@ -10,8 +10,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.issue.number || github.run_id }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
+# built-in GitHub token/permissions are not used
+permissions: {}
 
 env:
   FEEDBACK_LBL: pending::feedback
@@ -19,8 +19,6 @@ env:
 
 jobs:
   # NOTE: will update label if anyone responds, not just the author/reporter
-  # TODO: create conda-issue-sorting team and modify this to toggle label based on
-  # whether a non-issue-sorting engineer commented
   pending_support:
     name: Update pending support label
     # if [pending::feedback] and anyone responds
@@ -29,18 +27,14 @@ jobs:
       && !github.event.issue.pull_request
       && contains(github.event.issue.labels.*.name, 'pending::feedback')
     runs-on: ubuntu-slim
-    permissions:
-      contents: read
-      issues: write  # Required to remove and add issue triage labels.
     steps:
       # remove [pending::feedback]
-      - uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 # v1.3.0
-        with:
-          labels: ${{ env.FEEDBACK_LBL }}
-          github_token: ${{ secrets.PROJECT_TOKEN }}
+      - run: gh issue edit --remove-label "${FEEDBACK_LBL}"
+        env:
+          GITHUB_TOKEN: ${{ secrets.PROJECT_TOKEN }}
+
       # add [pending::support], if still open
-      - uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
-        if: github.event.issue.state == 'open'
-        with:
-          labels: ${{ env.SUPPORT_LBL }}
-          github_token: ${{ secrets.PROJECT_TOKEN }}
+      - if: github.event.issue.state == 'open'
+        run: gh issue edit --add-label "${SUPPORT_LBL}"
+        env:
+          GITHUB_TOKEN: ${{ secrets.PROJECT_TOKEN }}
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 02a9c1e..390cf0b 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -34,7 +34,7 @@ jobs:
       GLOBAL: https://raw.githubusercontent.com/conda/infra/main/.github/global.yml
       LOCAL: .github/labels.yml
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 2c43c06..6de824c 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -40,12 +40,13 @@ jobs:
             days-before-issue-stale: 90
             days-before-issue-close: 21
     steps:
-      - uses: conda/actions/read-yaml@7f6830b1428a9bd47f0b068892c77eae95207037 # v26.1.0
-        id: read_yaml
+      - uses: conda/actions/read-file@d88418cd4e36358ba51e7c88f2d2d5edb9ac49e7 # v26.8.1
+        id: read_messages
         with:
           path: https://raw.githubusercontent.com/conda/infra/main/.github/messages.yml
+          parser: yaml
 
-      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         id: stale
         with:
           # Only issues with these labels are checked whether they are stale
@@ -61,7 +62,7 @@ jobs:
           days-before-pr-close: 30
 
           # Comment on the staled issues
-          stale-issue-message: ${{ fromJSON(steps.read_yaml.outputs.value)['stale-issue'] }}
+          stale-issue-message: ${{ fromJSON(steps.read_messages.outputs.content)['stale-issue'] }}
           # Label to apply on staled issues
           stale-issue-label: stale
           # Label to apply on closed issues
@@ -70,7 +71,7 @@ jobs:
           close-issue-reason: not_planned
 
           # Comment on the staled PRs
-          stale-pr-message: ${{ fromJSON(steps.read_yaml.outputs.value)['stale-pr'] }}
+          stale-pr-message: ${{ fromJSON(steps.read_messages.outputs.content)['stale-pr'] }}
           # Label to apply on staled PRs
           stale-pr-label: stale
           # Label to apply on closed PRs
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index b0ef94d..d852933 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -24,7 +24,7 @@ jobs:
       pull-requests: write  # Required to open the generated update pull request.
       issues: write  # Required for generated update pull request metadata.
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -33,11 +33,11 @@ jobs:
           git config --global user.name 'Conda Bot'
           git config --global user.email '18747875+conda-bot@users.noreply.github.com'
 
-      - uses: conda/actions/combine-durations@7f6830b1428a9bd47f0b068892c77eae95207037 # v26.1.0
+      - uses: conda/actions/combine-durations@d88418cd4e36358ba51e7c88f2d2d5edb9ac49e7 # v26.8.1
         id: durations
         continue-on-error: true
 
-      - uses: conda/actions/template-files@7f6830b1428a9bd47f0b068892c77eae95207037 # v26.1.0
+      - uses: conda/actions/template-files@d88418cd4e36358ba51e7c88f2d2d5edb9ac49e7 # v26.8.1
         id: templates
         continue-on-error: true