diff --git a/tool/versions.env b/tool/versions.env
index d043dd8..d390752 100644
--- a/tool/versions.env
+++ b/tool/versions.env
@@ -33,13 +33,13 @@ ACTIONLINT_VERSION="1.7.12"
 
 # zizmor — the security half of the pr-checks gate, run via `pipx run`. pipx
 # resolves the version from PyPI, so no separate sha is tracked.
-ZIZMOR_VERSION="1.28.0"
+ZIZMOR_VERSION="1.29.0"
 
 # pinact — pins third-party actions inside composite action.yml to a SHA in the
 # composite-refs sweep (upgrade-check.yml), closing the dependabot-core#6704
 # blind spot. Go-installed by this tag; Go verifies the module checksum, so no
 # separate sha is tracked.
-PINACT_VERSION="4.1.0"
+PINACT_VERSION="4.1.1"
 
 # ── Pinned binary downloads (verified via tool/fetch_verified.sh) ──
 # sha256 values are the upstream-published digest where one exists, else
@@ -58,10 +58,10 @@ BORE_SHA256_WINDOWS_X64="01709c64fe2787cdc9a21d7030b0f08ad72dff0c36b7ecb72f4f667
 # chrome-for-testing publishes no digests, so these are self-computed.
 # upgrade.sh re-bumps on Chrome's ~4-week Stable cadence; the CDN prunes old
 # versions, so the pin must be kept fresh or the download 404s.
-CHROME_VERSION="151.0.7922.47"
-CHROME_SHA256_LINUX_X64="14ac03a67e154e3f8bbc57e03ef03315fda8fedff8e045eee8b31500283a33f4"
-CHROME_SHA256_MACOS_ARM64="9529990b6afd9867a862c7a5bff2a4a8eef84614d910acac22e4c5fa5c24daee"
-CHROME_SHA256_WINDOWS_X64="fc77bb98b550b7da23b14edfa282b59a022e7fdb075ac7625d2a5152ceb22396"
-CHROMEDRIVER_SHA256_LINUX_X64="2faa72828261cd3c5ff00cbc71cfca57a12c26c1406e084e1a34d8d90e292140"
-CHROMEDRIVER_SHA256_MACOS_ARM64="d450678936f5a2b39598a4e7d548177931a7a5c4759c0e4824f2cab1ae26523e"
-CHROMEDRIVER_SHA256_WINDOWS_X64="8af9c85a8793ae9fa09783a2a554234d4aae05b44a8254cf6a674e3e4e247b30"
+CHROME_VERSION="152.0.7977.42"
+CHROME_SHA256_LINUX_X64="cb77f4781cad7d5e06fcc78b4476e6a6375616e7278dc313abaa9db22ed4674e"
+CHROME_SHA256_MACOS_ARM64="c9a7b6bfb57731944990ffb7cafc17ae2f2a2e25ad1f145f45584d7b799d3ce8"
+CHROME_SHA256_WINDOWS_X64="5093f03a401b5579da490d281aba80b687d92fe6fdfec47ee522920918d6e327"
+CHROMEDRIVER_SHA256_LINUX_X64="d6625ea71d0bd3dc0afb45b559d6737d5a5fccfbc04621ad9429e7668de65503"
+CHROMEDRIVER_SHA256_MACOS_ARM64="c6ef55f25a0524c7b82f7cd6aff0ed8906c90047743dd9ad3dac763c1422b47d"
+CHROMEDRIVER_SHA256_WINDOWS_X64="fe5b997d7415dd148970d2b694f4d95ac0735ab352feddcc62a8c89112074061"