diff --git a/.github/workflows/build-test-release.yaml b/.github/workflows/build-test-release.yaml
index d9dc159..2520531 100644
--- a/.github/workflows/build-test-release.yaml
+++ b/.github/workflows/build-test-release.yaml
@@ -182,7 +182,7 @@ on:
         required: false
         type: string
         # yamllint disable-line rule:line-length
-        default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@60d8d71016f31c26775e5ec9380eba4264aa6f9e'  # v0.12.1
+        default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@bf6642f68d58c1b81bbe993e676d6cc339ac3654'  # v0.12.2
 
       # --- Gerrit-aware checkout (empty unless dispatched via Gerrit) ---
       gerrit_refspec:
diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml
index 7a0b8aa..83fa52f 100644
--- a/.github/workflows/build-test.yaml
+++ b/.github/workflows/build-test.yaml
@@ -177,7 +177,7 @@ on:
         required: false
         type: string
         # yamllint disable-line rule:line-length
-        default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@60d8d71016f31c26775e5ec9380eba4264aa6f9e'  # v0.12.1
+        default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@bf6642f68d58c1b81bbe993e676d6cc339ac3654'  # v0.12.2
 
       # --- Gerrit-aware checkout (empty unless dispatched via Gerrit) ---
       gerrit_refspec:
diff --git a/.github/workflows/clear-action-cache.yaml b/.github/workflows/clear-action-cache.yaml
index eba3732..34405d8 100644
--- a/.github/workflows/clear-action-cache.yaml
+++ b/.github/workflows/clear-action-cache.yaml
@@ -55,7 +55,7 @@ jobs:
       # yamllint disable-line rule:line-length
       - uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d  # v0.2.1
         with:
-          config: '@18d9c4446bea555d0783e850f6d295f844fe8f67'  # v0.1.1
+          config: '@bf6642f68d58c1b81bbe993e676d6cc339ac3654'  # v0.12.2
 
       # Harden the runner with the just-loaded allow-list.
       - name: 'Harden runner (block)'
diff --git a/.github/workflows/merge.yaml b/.github/workflows/merge.yaml
index 0b75c79..86c8e38 100644
--- a/.github/workflows/merge.yaml
+++ b/.github/workflows/merge.yaml
@@ -120,7 +120,7 @@ on:
         required: false
         type: string
         # yamllint disable-line rule:line-length
-        default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@60d8d71016f31c26775e5ec9380eba4264aa6f9e'  # v0.12.1
+        default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@bf6642f68d58c1b81bbe993e676d6cc339ac3654'  # v0.12.2
 
       # --- Gerrit-aware checkout (empty unless dispatched via Gerrit) ---
       gerrit_refspec:
diff --git a/.github/workflows/release-drafter.yaml b/.github/workflows/release-drafter.yaml
index f197101..cc2ed93 100644
--- a/.github/workflows/release-drafter.yaml
+++ b/.github/workflows/release-drafter.yaml
@@ -30,7 +30,7 @@ jobs:
       # yamllint disable-line rule:line-length
       - uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d  # v0.2.1
         with:
-          config: '@18d9c4446bea555d0783e850f6d295f844fe8f67'  # v0.1.1
+          config: '@bf6642f68d58c1b81bbe993e676d6cc339ac3654'  # v0.12.2
 
       # Harden the runner with the just-loaded allow-list.
       - name: 'Harden runner (block)'
diff --git a/.github/workflows/tag-push.yaml b/.github/workflows/tag-push.yaml
index ca8a194..6052dc7 100644
--- a/.github/workflows/tag-push.yaml
+++ b/.github/workflows/tag-push.yaml
@@ -38,7 +38,7 @@ jobs:
       # yamllint disable-line rule:line-length
       - uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d  # v0.2.1
         with:
-          config: '@18d9c4446bea555d0783e850f6d295f844fe8f67'  # v0.1.1
+          config: '@bf6642f68d58c1b81bbe993e676d6cc339ac3654'  # v0.12.2
 
       # Harden the runner with the just-loaded allow-list.
       - name: 'Harden runner (block)'
@@ -80,7 +80,7 @@ jobs:
       # yamllint disable-line rule:line-length
       - uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d  # v0.2.1
         with:
-          config: '@18d9c4446bea555d0783e850f6d295f844fe8f67'  # v0.1.1
+          config: '@bf6642f68d58c1b81bbe993e676d6cc339ac3654'  # v0.12.2
 
       # Harden the runner with the just-loaded allow-list.
       - name: 'Harden runner (block)'