diff --git a/automation/source-repo-templates/api-docs.typescript.yml b/automation/source-repo-templates/api-docs.typescript.yml
index b1d27325..d30f9c7f 100644
--- a/automation/source-repo-templates/api-docs.typescript.yml
+++ b/automation/source-repo-templates/api-docs.typescript.yml
@@ -76,7 +76,7 @@ jobs:
         # workflow_dispatch can pass an alternate ref via inputs.ref;
         # fall back to github.ref_name (already stripped of refs/...).
         # DOCS_REF_SLUG is branch-safe for use in PR/branch names
-        # (`@resq-sw/ui@v0.35.6` → `resq-sw-ui-v0.35.6`).
+        # (`@resq-systems/ui@v0.35.6` → `resq-systems-ui-v0.35.6`).
         #
         # The ref is routed through env: instead of being inlined via
         # ${{ }}. Inlining at template-expansion time would interpolate
@@ -98,15 +98,22 @@ jobs:
           } >> "$GITHUB_ENV"
 
       - name: Checkout source repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.ref || github.ref }}
           persist-credentials: false
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: latest
+          # This job runs on release tags and opens a cross-repo PR using
+          # DOCS_REPO_PR_TOKEN, so it is a privileged context. Disable
+          # setup-bun's default dependency cache: a cache populated by a
+          # less-trusted run must not be restorable here (zizmor
+          # cache-poisoning, error severity). The install step below is
+          # --frozen-lockfile, so a cold install is functionally identical.
+          no-cache: true
 
       - name: Install workspace deps
         run: bun install --frozen-lockfile
@@ -503,7 +510,7 @@ jobs:
           rm _pages.txt
 
       - name: Checkout docs repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: resq-software/docs
           path: docs-checkout
@@ -617,7 +624,7 @@ jobs:
           PYINNER
 
       - name: Open PR in docs repo
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           path: docs-checkout
           token: ${{ secrets.DOCS_REPO_PR_TOKEN }}