diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1bf6c0b2f..4883b203e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,8 +9,19 @@ updates:
       # Un major por paquete rompe los 5 workspaces (ver PRs #720 y #721, cerrados).
       - dependency-name: "@nestjs/*"
         update-types: ["version-update:semver-major"]
+      # nestjs-pino 5.x exige Node >= 22.12 y el repo corre en Node 20 por diseño
+      # (engines raíz `>=20 <21`, imágenes node:20-alpine). Es una migración de
+      # runtime, no un bump (ver PR #727, cerrado).
+      - dependency-name: "nestjs-pino"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: monthly
+    groups:
+      # init, autobuild, analyze y upload-sarif tienen que moverse JUNTOS: analyze
+      # rechaza la configuración escrita por un init de otra versión (ver PRs #731
+      # y #733, cerrados). Dependabot los trata como dependencias distintas.
+      codeql-action:
+        patterns: ["github/codeql-action*"]
diff --git a/.github/workflows/openssf-scorecard.yml b/.github/workflows/openssf-scorecard.yml
index bed418ef2..c337ad5bc 100644
--- a/.github/workflows/openssf-scorecard.yml
+++ b/.github/workflows/openssf-scorecard.yml
@@ -112,7 +112,7 @@ jobs:
           retention-days: 90
 
       - name: Upload results to code scanning
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: scorecard-results.sarif
 
diff --git a/.github/workflows/sdk-cli-ci.yml b/.github/workflows/sdk-cli-ci.yml
index 387e69e10..ea7dad28a 100644
--- a/.github/workflows/sdk-cli-ci.yml
+++ b/.github/workflows/sdk-cli-ci.yml
@@ -421,16 +421,16 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           languages: javascript-typescript
           queries: security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           category: "/language:javascript-typescript"
 
@@ -457,7 +457,7 @@ jobs:
           severity: 'CRITICAL,HIGH'
 
       - name: Upload Trivy SARIF Report
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'
diff --git a/package-lock.json b/package-lock.json
index 03b8fba0b..99432b840 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13747,22 +13747,6 @@
         "node": ">= 0.8"
       }
     },
-    "node_modules/passport-custom": {
-      "version": "1.1.1",
-      "license": "MIT",
-      "dependencies": {
-        "passport-strategy": "1.x.x"
-      },
-      "engines": {
-        "node": ">= 0.10.0"
-      }
-    },
-    "node_modules/passport-strategy": {
-      "version": "1.0.0",
-      "engines": {
-        "node": ">= 0.4.0"
-      }
-    },
     "node_modules/path-exists": {
       "version": "4.0.0",
       "dev": true,
@@ -16293,7 +16277,6 @@
         "helmet": "8.2.0",
         "keyv": "5.6.0",
         "nestjs-pino": "4.6.1",
-        "passport-custom": "1.1.1",
         "pino": "10.3.1",
         "pino-http": "11.0.0",
         "prom-client": "15.1.3",
@@ -16514,7 +16497,7 @@
       "license": "MIT",
       "dependencies": {
         "@beyondnet/evolith-core-domain": "^1.3.0",
-        "yaml": "^2.9.1"
+        "yaml": "2.9.1"
       },
       "devDependencies": {
         "@types/jest": "30.0.0",
@@ -16604,7 +16587,7 @@
         "ajv": "8.20.0",
         "ajv-formats": "3.0.1",
         "typescript": "6.0.3",
-        "yaml": "^2.9.1",
+        "yaml": "2.9.1",
         "zod": "4.4.3"
       },
       "devDependencies": {
@@ -16850,7 +16833,7 @@
         "ajv": "8.20.0",
         "ajv-formats": "3.0.1",
         "fs-extra": "10.1.0",
-        "yaml": "^2.9.1"
+        "yaml": "2.9.1"
       },
       "devDependencies": {
         "@types/fs-extra": "11.0.4",
@@ -16917,7 +16900,7 @@
         "prom-client": "15.1.3",
         "reflect-metadata": "0.2.2",
         "rxjs": "7.8.2",
-        "yaml": "^2.9.1"
+        "yaml": "2.9.1"
       },
       "bin": {
         "evolith-mcp": "dist/main.js"
@@ -17328,7 +17311,7 @@
         "@beyondnet/evolith-core-domain": "1.3.2",
         "@beyondnet/evolith-infra-providers": "1.2.1",
         "@beyondnet/evolith-sdk": "2.0.0",
-        "@clack/prompts": "^1.8.1",
+        "@clack/prompts": "1.8.1",
         "@hono/node-server": "1.19.15",
         "@modelcontextprotocol/sdk": "1.29.0",
         "@nestjs/common": "11.2.1",
@@ -17348,7 +17331,7 @@
         "inherits": "2.0.4",
         "nest-commander": "3.20.1",
         "path-to-regexp": "8.4.2",
-        "yaml": "^2.9.1"
+        "yaml": "2.9.1"
       },
       "bin": {
         "evolith": "dist/main.js",
diff --git a/src/apps/core-api/package.json b/src/apps/core-api/package.json
index cceaab328..d73ba2974 100644
--- a/src/apps/core-api/package.json
+++ b/src/apps/core-api/package.json
@@ -42,7 +42,6 @@
     "helmet": "8.2.0",
     "keyv": "5.6.0",
     "nestjs-pino": "4.6.1",
-    "passport-custom": "1.1.1",
     "pino": "10.3.1",
     "pino-http": "11.0.0",
     "prom-client": "15.1.3",