diff --git a/.github/workflows/agent-discovery-verify.yml b/.github/workflows/agent-discovery-verify.yml
index 9140d0d9a3..8079deffc2 100644
--- a/.github/workflows/agent-discovery-verify.yml
+++ b/.github/workflows/agent-discovery-verify.yml
@@ -51,7 +51,7 @@ jobs:
       labels: linux-ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/deps-proxy-allowlist.yml b/.github/workflows/deps-proxy-allowlist.yml
index 2ae9e0df3e..d2a7ed7d60 100644
--- a/.github/workflows/deps-proxy-allowlist.yml
+++ b/.github/workflows/deps-proxy-allowlist.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || fromJSON('{"group":"neondatabase-protected-runner-group","labels":"linux-ubuntu-latest"}') }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/docs-api-consistency.yml b/.github/workflows/docs-api-consistency.yml
index 32d9164b02..f9136d9a89 100644
--- a/.github/workflows/docs-api-consistency.yml
+++ b/.github/workflows/docs-api-consistency.yml
@@ -43,7 +43,7 @@ jobs:
       labels: linux-ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
index 33128dbc2b..7ca2a5e792 100644
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -43,7 +43,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/format-markdown.yml b/.github/workflows/format-markdown.yml
index f1e6482fd9..1017908ae5 100644
--- a/.github/workflows/format-markdown.yml
+++ b/.github/workflows/format-markdown.yml
@@ -22,7 +22,7 @@ jobs:
       labels: linux-ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/linkinator.yml b/.github/workflows/linkinator.yml
index af4ad3f6a5..7b5eba6850 100644
--- a/.github/workflows/linkinator.yml
+++ b/.github/workflows/linkinator.yml
@@ -18,7 +18,7 @@ jobs:
     continue-on-error: true
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/mcp-categories-sync.yml b/.github/workflows/mcp-categories-sync.yml
index 39e582e00a..a124adb032 100644
--- a/.github/workflows/mcp-categories-sync.yml
+++ b/.github/workflows/mcp-categories-sync.yml
@@ -39,7 +39,7 @@ jobs:
       labels: linux-ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/skills-readonly.yml b/.github/workflows/skills-readonly.yml
index 35951a6495..2d28026c1d 100644
--- a/.github/workflows/skills-readonly.yml
+++ b/.github/workflows/skills-readonly.yml
@@ -37,7 +37,7 @@ jobs:
       labels: linux-ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 1114d8a72d..3c91a0d4f4 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -17,7 +17,7 @@ jobs:
       labels: linux-ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit