diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 85220a3..3f00bce 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -40,7 +40,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -54,6 +54,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: results.sarif
diff --git a/AUDIT.md b/AUDIT.md
index a9d4440..767eb2b 100644
--- a/AUDIT.md
+++ b/AUDIT.md
@@ -1,5 +1,15 @@
 # Cycles Protocol v0.1.25 — Client (Python) Audit
 
+## 2026-10-19 — Dependabot dependency review
+
+Consolidates the following reviewed updates on current main:
+
+- PR #106: chore(deps): bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0
+- PR #107: chore(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0
+
+Workflow actions remain pinned to verified upstream commit SHAs. Existing supported runtime versions, application code, and YAML protocol contracts are preserved. Existing lint, build, test, coverage, conformance, and applicable security checks must pass on the combined commit before merge; coverage requirements are not lowered.
+
+
 ## 2026-10-11 — Dependency maintenance
 
 PR #104 updates the SHA-pinned download-artifact action from 8.0.1 to 8.0.2, which includes artifact-service rate-limit retry handling. The branch is brought up to date with main. Python dependencies, SDK source, and YAML protocol fixtures are unchanged. Existing Python 3.10/3.12 lint, typing, build, coverage, and durable recovery conformance checks remain enabled and must pass before merge.