diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index abb7cfa..103d15d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,9 +24,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12'
           cache: pip
@@ -62,9 +62,9 @@ jobs:
         python-version: ['3.11', '3.12', '3.13']
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
@@ -117,7 +117,7 @@ jobs:
     runs-on: windows-latest
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Parse update.ps1 / install.ps1 under Windows PowerShell 5.1
         shell: powershell
@@ -153,9 +153,9 @@ jobs:
     runs-on: windows-latest
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12'
           cache: pip
@@ -248,9 +248,9 @@ jobs:
             extras: ".[dev]"
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12'
           cache: pip
diff --git a/.github/workflows/live-canary.yml b/.github/workflows/live-canary.yml
index 03ff4c3..bf07334 100644
--- a/.github/workflows/live-canary.yml
+++ b/.github/workflows/live-canary.yml
@@ -38,9 +38,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12'
           cache: pip
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c28548d..4ccf612 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,7 +22,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Verify tag matches pyproject.toml version
         shell: bash
@@ -52,9 +52,9 @@ jobs:
     runs-on: windows-latest
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12'
           cache: pip
@@ -157,7 +157,7 @@ jobs:
           Write-Host "SHA256SUMS: $hash  PlaudTools.zip"
 
       - name: Publish GitHub release
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           files: |
             PlaudTools.zip
@@ -173,8 +173,8 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12'
           cache: pip
diff --git a/constraints/linux.txt b/constraints/linux.txt
index 67a531d..89b02e4 100644
--- a/constraints/linux.txt
+++ b/constraints/linux.txt
@@ -32,7 +32,7 @@ certifi==2026.5.20
     #   httpx
 cffi==2.0.0
     # via cryptography
-click==8.4.1
+click==8.4.2
     # via uvicorn
 cryptography==49.0.0
     # via
@@ -106,7 +106,7 @@ pydantic-settings==2.14.1
     # via mcp
 pygments==2.20.0
     # via pytest
-pyinstaller==6.20.0
+pyinstaller==6.21.0
     # via plaud-tools (pyproject.toml)
 pyinstaller-hooks-contrib==2026.6
     # via pyinstaller
@@ -153,5 +153,5 @@ typing-inspection==0.4.2
     #   mcp
     #   pydantic
     #   pydantic-settings
-uvicorn==0.49.0
+uvicorn==0.50.2
     # via mcp
diff --git a/constraints/macos.txt b/constraints/macos.txt
index f284ac8..6709560 100644
--- a/constraints/macos.txt
+++ b/constraints/macos.txt
@@ -34,7 +34,7 @@ certifi==2026.5.20
     #   httpx
 cffi==2.0.0
     # via cryptography
-click==8.4.1
+click==8.4.2
     # via uvicorn
 cryptography==49.0.0
     # via pyjwt
@@ -104,7 +104,7 @@ pydantic-settings==2.14.1
     # via mcp
 pygments==2.20.0
     # via pytest
-pyinstaller==6.20.0
+pyinstaller==6.21.0
     # via plaud-tools (pyproject.toml)
 pyinstaller-hooks-contrib==2026.6
     # via pyinstaller
@@ -149,5 +149,5 @@ typing-inspection==0.4.2
     #   mcp
     #   pydantic
     #   pydantic-settings
-uvicorn==0.49.0
+uvicorn==0.50.2
     # via mcp
diff --git a/constraints/windows.txt b/constraints/windows.txt
index 4c08d04..ae0d3d5 100644
--- a/constraints/windows.txt
+++ b/constraints/windows.txt
@@ -32,7 +32,7 @@ certifi==2026.5.20
     #   httpx
 cffi==2.0.0
     # via cryptography
-click==8.4.1
+click==8.4.2
     # via uvicorn
 colorama==0.4.6
     # via
@@ -93,7 +93,7 @@ pathspec==1.1.1
     # via mypy
 pefile==2024.8.26
     # via pyinstaller
-pillow==12.2.0
+pillow==12.3.0
     # via
     #   plaud-tools (pyproject.toml)
     #   pystray
@@ -113,7 +113,7 @@ pydantic-settings==2.14.1
     # via mcp
 pygments==2.20.0
     # via pytest
-pyinstaller==6.20.0
+pyinstaller==6.21.0
     # via plaud-tools (pyproject.toml)
 pyinstaller-hooks-contrib==2026.6
     # via pyinstaller
@@ -170,5 +170,5 @@ typing-inspection==0.4.2
     #   mcp
     #   pydantic
     #   pydantic-settings
-uvicorn==0.49.0
+uvicorn==0.50.2
     # via mcp