diff --git a/.github/workflows/pr_mise_lock.yaml b/.github/workflows/pr_mise_lock.yaml
index 3093a02b..60b1209d 100644
--- a/.github/workflows/pr_mise_lock.yaml
+++ b/.github/workflows/pr_mise_lock.yaml
@@ -20,7 +20,7 @@ jobs:
       # yamllint disable-line rule:line-length
       - name: Generate GitHub token
         # https://github.com/actions/create-github-app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: generate-token
         with:
           app-id: ${{ secrets.APP_ID }}
@@ -33,10 +33,10 @@ jobs:
           ref: ${{ github.event.pull_request.head.ref }}
           token: ${{ steps.generate-token.outputs.token }}
       - name: install mise
-        uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1
+        uses: jdx/mise-action@fc42bcc7ddbf51124c30f95a877a0c5168a3bfde # v5.2.1
         with:
           # renovate: datasource=github-releases depName=jdx/mise
-          version: 2026.10.8
+          version: 2026.10.17
           install: false
           # Lock generation needs no exported tool paths from the stale lock.
           env: false
diff --git a/.github/workflows/pr_renovate_release_notes.yaml b/.github/workflows/pr_renovate_release_notes.yaml
index 680c148e..e618e6c4 100644
--- a/.github/workflows/pr_renovate_release_notes.yaml
+++ b/.github/workflows/pr_renovate_release_notes.yaml
@@ -27,7 +27,7 @@ jobs:
           persist-credentials: false
       - name: Generate GitHub App token
         id: generate-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -35,7 +35,7 @@ jobs:
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
-          node-version: 24.21.0
+          node-version: 24.22.0
           package-manager-cache: false
       - name: Update release notes comment
         env:
diff --git a/.github/workflows/release_please.yml b/.github/workflows/release_please.yml
index 550b4aff..ea4a1526 100644
--- a/.github/workflows/release_please.yml
+++ b/.github/workflows/release_please.yml
@@ -14,7 +14,7 @@ jobs:
     steps:
       - name: Generate GitHub token
         # yamllint disable-line rule:line-length
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         # https://github.com/actions/create-github-app-token
         id: generate-token
         with:
diff --git a/mise/mise.lock b/mise/mise.lock
index 14756324..5e3594cd 100644
--- a/mise/mise.lock
+++ b/mise/mise.lock
@@ -637,9 +637,9 @@ url = "https://github.com/bootandy/dust/releases/download/v1.2.6/dust-v1.2.6-x86
 url_api = "https://api.github.com/repos/bootandy/dust/releases/assets/568853682"
 
 [tools."aqua:bootandy/dust"."platforms.macos-arm64"]
-checksum = "sha256:7603c92462bd56305847732eb25d70ab06386d7bcfbce7532b7cf3937fd9684f"
-url = "https://github.com/bootandy/dust/releases/download/v1.2.6/dust-v1.2.6-x86_64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/bootandy/dust/releases/assets/568852877"
+checksum = "sha256:5c37ee0d353165c73aedd6b21b9133182221efe08f9a5e76c082d9d6d5a0935d"
+url = "https://github.com/bootandy/dust/releases/download/v1.2.6/dust-v1.2.6-aarch64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/bootandy/dust/releases/assets/568852617"
 
 [tools."aqua:bootandy/dust"."platforms.macos-x64"]
 checksum = "sha256:7603c92462bd56305847732eb25d70ab06386d7bcfbce7532b7cf3937fd9684f"