diff --git a/.github/workflows/act-image-repin.yml b/.github/workflows/act-image-repin.yml
index 7048d89..1e0aa34 100644
--- a/.github/workflows/act-image-repin.yml
+++ b/.github/workflows/act-image-repin.yml
@@ -101,7 +101,7 @@ jobs:
 
       - name: Set up Go
         if: steps.resolve.outputs.changed == 'true'
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: e2e/go.mod
 
diff --git a/.github/workflows/action-pins.yml b/.github/workflows/action-pins.yml
index 59ed4b3..e1a5d70 100644
--- a/.github/workflows/action-pins.yml
+++ b/.github/workflows/action-pins.yml
@@ -62,7 +62,7 @@ jobs:
         with:
           path: .
           key: anchor
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
       - uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
diff --git a/.github/workflows/build-cli.yaml b/.github/workflows/build-cli.yaml
index 7e5cfc9..65c2c6d 100644
--- a/.github/workflows/build-cli.yaml
+++ b/.github/workflows/build-cli.yaml
@@ -31,7 +31,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
diff --git a/.github/workflows/cli-install-selftest.yaml b/.github/workflows/cli-install-selftest.yaml
index d996594..a045374 100644
--- a/.github/workflows/cli-install-selftest.yaml
+++ b/.github/workflows/cli-install-selftest.yaml
@@ -72,7 +72,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
 
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index 7f6ac1b..e0abf08 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -153,7 +153,7 @@ jobs:
           # that triggered the run so we test what GitHub resolved.
           ref: ${{ github.event.inputs.ref || github.sha }}
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           # The e2e module declares its own toolchain (go 1.24). Drive the
           # installed Go straight from e2e/go.mod so the runner always matches
diff --git a/.github/workflows/fleet-reconcile.yaml b/.github/workflows/fleet-reconcile.yaml
index 2574165..5ed71a4 100644
--- a/.github/workflows/fleet-reconcile.yaml
+++ b/.github/workflows/fleet-reconcile.yaml
@@ -116,7 +116,7 @@ jobs:
           ref: ${{ inputs.cascade-ref || github.workflow_sha }}
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
diff --git a/.github/workflows/nightly-release.yaml b/.github/workflows/nightly-release.yaml
index 68077fe..7173b4a 100644
--- a/.github/workflows/nightly-release.yaml
+++ b/.github/workflows/nightly-release.yaml
@@ -202,7 +202,7 @@ jobs:
           # Check out with the PAT so the tag push below triggers Release.
           token: ${{ secrets.CASCADE_STATE_TOKEN }}
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         if: github.event.inputs.dry_run == 'true'
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/orchestrate.yaml b/.github/workflows/orchestrate.yaml
index 60ef16a..4afaeba 100644
--- a/.github/workflows/orchestrate.yaml
+++ b/.github/workflows/orchestrate.yaml
@@ -108,19 +108,7 @@ jobs:
           if [[ "$HAS_OUTPUTS" == "false" ]]; then
             echo "_No outputs produced_" >> "$GITHUB_STEP_SUMMARY"
           fi
-      - name: Download cascade CLI (from source)
-        if: needs.build-cli.result == 'success'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: cascade-cli
-          path: .cascade-bin
-      - name: Install cascade CLI (from source)
-        if: needs.build-cli.result == 'success'
-        run: |
-          chmod +x .cascade-bin/cascade
-          echo "$GITHUB_WORKSPACE/.cascade-bin" >> "$GITHUB_PATH"
       - name: Setup CLI
-        if: needs.build-cli.result != 'success'
         uses: stablekernel/cascade/.github/actions/setup-cli@58c3d309faaf5028aa03900aded8424e738afb81 # v0.8.0
         with:
           token: ${{ secrets.CASCADE_STATE_TOKEN }}
@@ -145,12 +133,11 @@ jobs:
           action: update
           tag: ${{ needs.setup.outputs.version }}
           create_tag: 'true'
-          tag_only: 'true'
           environment: prerelease
           sha: ${{ needs.setup.outputs.head_sha }}
           changelog_file: ${{ runner.temp }}/cascade-changelog.md
           previous_tag: ${{ needs.setup.outputs.previous_tag }}
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.CASCADE_STATE_TOKEN }}
       - name: Dispatch Release Candidate Build
         if: ${{ github.server_url == 'https://github.com' }}
         env:
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index 2d03c3b..c4c3016 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -64,7 +64,7 @@ jobs:
           fetch-tags: true
           fetch-depth: 0
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -107,7 +107,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -133,7 +133,7 @@ jobs:
           # the changed governed source files a pin bump would land in.
           fetch-depth: 0
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e500f77..c8c8206 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -62,7 +62,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
 
@@ -119,7 +119,7 @@ jobs:
 
       - name: Set up Go
         if: steps.idem.outputs.skip != 'true'
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
 
diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml
index 28f91d5..abe5bff 100644
--- a/.github/workflows/validate.yaml
+++ b/.github/workflows/validate.yaml
@@ -49,7 +49,7 @@ jobs:
           fetch-tags: true
           fetch-depth: 0
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -95,7 +95,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -111,7 +111,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -137,7 +137,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
diff --git a/internal/generate/action_pins.yaml b/internal/generate/action_pins.yaml
index 727055e..ddc1157 100644
--- a/internal/generate/action_pins.yaml
+++ b/internal/generate/action_pins.yaml
@@ -10,14 +10,58 @@
 # sha is the 40-hex commit the tag/version resolves to. version is the precise
 # release the sha corresponds to, carried as the trailing uses: comment.
 actions:
-  actions/checkout:                { tag: v7, sha: 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0, version: v7.0.0, emit: true }
-  actions/github-script:           { tag: v9, sha: 3a2844b7e9c422d3c10d287c895573f7108da1b3, version: v9.0.0, emit: true }
-  actions/download-artifact:       { tag: v8, sha: 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c, version: v8.0.1, emit: true }
-  actions/upload-artifact:         { tag: v7, sha: 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a, version: v7.0.1, emit: true }
-  actions/create-github-app-token: { tag: v3, sha: bcd2ba49218906704ab6c1aa796996da409d3eb1, version: v3.2.0, emit: true }
-  actions/cache:                   { tag: v6, sha: 55cc8345863c7cc4c66a329aec7e433d2d1c52a9, version: v6.1.0, emit: false }
-  actions/setup-go:                { tag: v6, sha: 924ae3a1cded613372ab5595356fb5720e22ba16, version: v6.5.0, emit: false }
-  actions/setup-node:              { tag: v6, sha: 48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e, version: v6.4.0, emit: false }
-  actions/upload-pages-artifact:   { tag: v5, sha: fc324d3547104276b827a68afc52ff2a11cc49c9, version: v5.0.0, emit: false }
-  actions/deploy-pages:            { tag: v5, sha: cd2ce8fcbc39b97be8ca5fce6e763baed58fa128, version: v5.0.0, emit: false }
-  sigstore/cosign-installer:       { tag: v4, sha: 6f9f17788090df1f26f669e9d70d6ae9567deba6, version: v4.1.2, emit: false }
+    actions/cache:
+        tag: v6
+        sha: 55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        version: v6.1.0
+        emit: false
+    actions/checkout:
+        tag: v7
+        sha: 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        version: v7.0.0
+        emit: true
+    actions/create-github-app-token:
+        tag: v3
+        sha: bcd2ba49218906704ab6c1aa796996da409d3eb1
+        version: v3.2.0
+        emit: true
+    actions/deploy-pages:
+        tag: v5
+        sha: cd2ce8fcbc39b97be8ca5fce6e763baed58fa128
+        version: v5.0.0
+        emit: false
+    actions/download-artifact:
+        tag: v8
+        sha: 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        version: v8.0.1
+        emit: true
+    actions/github-script:
+        tag: v9
+        sha: 3a2844b7e9c422d3c10d287c895573f7108da1b3
+        version: v9.0.0
+        emit: true
+    actions/setup-go:
+        tag: v6
+        sha: b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+        version: v7.0.0
+        emit: false
+    actions/setup-node:
+        tag: v6
+        sha: 48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        version: v6.4.0
+        emit: false
+    actions/upload-artifact:
+        tag: v7
+        sha: 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        version: v7.0.1
+        emit: true
+    actions/upload-pages-artifact:
+        tag: v5
+        sha: fc324d3547104276b827a68afc52ff2a11cc49c9
+        version: v5.0.0
+        emit: false
+    sigstore/cosign-installer:
+        tag: v4
+        sha: 6f9f17788090df1f26f669e9d70d6ae9567deba6
+        version: v4.1.2
+        emit: false