diff --git a/.ci-mgmt.yaml b/.ci-mgmt.yaml
index b55955056c9..63fea142f93 100644
--- a/.ci-mgmt.yaml
+++ b/.ci-mgmt.yaml
@@ -80,7 +80,7 @@ extraTests:
       with:
         ref: ${{ env.PR_COMMIT_SHA }}
         submodules: true
-    - uses: pulumi/provider-version-action@v1
+    - uses: pulumi/provider-version-action@7c54f136703646f7d6eaa3d3b3c877e5a805d6ab # v1
       with:
         set-env: 'PROVIDER_VERSION'
     - name: Setup tools
@@ -146,7 +146,7 @@ extraTests:
       with:
         ref: ${{ env.PR_COMMIT_SHA }}
         submodules: true
-    - uses: pulumi/provider-version-action@v1
+    - uses: pulumi/provider-version-action@7c54f136703646f7d6eaa3d3b3c877e5a805d6ab # v1
       with:
         set-env: 'PROVIDER_VERSION'
     - name: Setup tools
@@ -208,7 +208,7 @@ extraTests:
         with:
           ref: ${{ env.PR_COMMIT_SHA }}
           submodules: true
-      - uses: pulumi/provider-version-action@v1
+      - uses: pulumi/provider-version-action@7c54f136703646f7d6eaa3d3b3c877e5a805d6ab # v1
         with:
           set-env: 'PROVIDER_VERSION'
       - name: Setup tools
diff --git a/.github/actions/setup-tools/action.yml b/.github/actions/setup-tools/action.yml
index 3277cca0d2c..5ae5477706f 100644
--- a/.github/actions/setup-tools/action.yml
+++ b/.github/actions/setup-tools/action.yml
@@ -37,7 +37,7 @@ runs:
 
     - name: Install Pulumi CLI
       if: inputs.tools == 'all' || contains(inputs.tools, 'pulumicli')
-      uses: pulumi/actions@v5
+      uses: pulumi/actions@c7fad9e2f0b79653172b36538b8b34b3c0291952 # v6
       with:
         pulumi-version: "dev"
 
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
index 4551b3d98cc..d710cfcbef3 100644
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@@ -216,7 +216,7 @@ jobs:
             with:
               ref: ${{ env.PR_COMMIT_SHA }}
               submodules: true
-          - uses: pulumi/provider-version-action@v1
+          - uses: pulumi/provider-version-action@7c54f136703646f7d6eaa3d3b3c877e5a805d6ab # v1
             with:
               set-env: PROVIDER_VERSION
           - name: Setup tools
@@ -254,7 +254,7 @@ jobs:
             with:
               ref: ${{ env.PR_COMMIT_SHA }}
               submodules: true
-          - uses: pulumi/provider-version-action@v1
+          - uses: pulumi/provider-version-action@7c54f136703646f7d6eaa3d3b3c877e5a805d6ab # v1
             with:
               set-env: PROVIDER_VERSION
           - name: Setup tools
@@ -324,7 +324,7 @@ jobs:
             with:
               ref: ${{ env.PR_COMMIT_SHA }}
               submodules: true
-          - uses: pulumi/provider-version-action@v1
+          - uses: pulumi/provider-version-action@7c54f136703646f7d6eaa3d3b3c877e5a805d6ab # v1
             with:
               set-env: PROVIDER_VERSION
           - name: Setup tools
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index 49a2bbdf3b3..d7d7ad59166 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -157,7 +157,7 @@ jobs:
             with:
               ref: ${{ env.PR_COMMIT_SHA }}
               submodules: true
-          - uses: pulumi/provider-version-action@v1
+          - uses: pulumi/provider-version-action@7c54f136703646f7d6eaa3d3b3c877e5a805d6ab # v1
             with:
               set-env: PROVIDER_VERSION
           - name: Setup tools
@@ -195,7 +195,7 @@ jobs:
             with:
               ref: ${{ env.PR_COMMIT_SHA }}
               submodules: true
-          - uses: pulumi/provider-version-action@v1
+          - uses: pulumi/provider-version-action@7c54f136703646f7d6eaa3d3b3c877e5a805d6ab # v1
             with:
               set-env: PROVIDER_VERSION
           - name: Setup tools
@@ -265,7 +265,7 @@ jobs:
             with:
               ref: ${{ env.PR_COMMIT_SHA }}
               submodules: true
-          - uses: pulumi/provider-version-action@v1
+          - uses: pulumi/provider-version-action@7c54f136703646f7d6eaa3d3b3c877e5a805d6ab # v1
             with:
               set-env: PROVIDER_VERSION
           - name: Setup tools
diff --git a/.github/workflows/prerequisites.yml b/.github/workflows/prerequisites.yml
index b2fad8b2c7a..9556b0295e9 100644
--- a/.github/workflows/prerequisites.yml
+++ b/.github/workflows/prerequisites.yml
@@ -57,7 +57,7 @@ jobs:
       with:
         submodules: true
         persist-credentials: false
-    - uses: pulumi/provider-version-action@v1
+    - uses: pulumi/provider-version-action@7c54f136703646f7d6eaa3d3b3c877e5a805d6ab # v1
       id: provider-version
       with:
         set-env: 'PROVIDER_VERSION'
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4c338581ab5..ebcb6297b33 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -124,7 +124,7 @@ jobs:
       with:
         tools: pulumictl, pulumicli, nodejs, python, dotnet, go, java
     - name: Publish SDKs
-      uses: pulumi/pulumi-package-publisher@v0.0.20
+      uses: pulumi/pulumi-package-publisher@1c0359ba74243cf6651efacfd839c751d8ff87e2 # v0.0.20
       with:
         sdk: all
         version: ${{ inputs.version }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5d101e36ba4..01a9c056ffc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -163,7 +163,7 @@ jobs:
             with:
               ref: ${{ env.PR_COMMIT_SHA }}
               submodules: true
-          - uses: pulumi/provider-version-action@v1
+          - uses: pulumi/provider-version-action@7c54f136703646f7d6eaa3d3b3c877e5a805d6ab # v1
             with:
               set-env: PROVIDER_VERSION
           - name: Setup tools
@@ -201,7 +201,7 @@ jobs:
             with:
               ref: ${{ env.PR_COMMIT_SHA }}
               submodules: true
-          - uses: pulumi/provider-version-action@v1
+          - uses: pulumi/provider-version-action@7c54f136703646f7d6eaa3d3b3c877e5a805d6ab # v1
             with:
               set-env: PROVIDER_VERSION
           - name: Setup tools
@@ -271,7 +271,7 @@ jobs:
             with:
               ref: ${{ env.PR_COMMIT_SHA }}
               submodules: true
-          - uses: pulumi/provider-version-action@v1
+          - uses: pulumi/provider-version-action@7c54f136703646f7d6eaa3d3b3c877e5a805d6ab # v1
             with:
               set-env: PROVIDER_VERSION
           - name: Setup tools
diff --git a/.github/workflows/run-acceptance-tests.yml b/.github/workflows/run-acceptance-tests.yml
index c7067d3f21e..d780ead8716 100644
--- a/.github/workflows/run-acceptance-tests.yml
+++ b/.github/workflows/run-acceptance-tests.yml
@@ -218,7 +218,7 @@ jobs:
             with:
               ref: ${{ env.PR_COMMIT_SHA }}
               submodules: true
-          - uses: pulumi/provider-version-action@v1
+          - uses: pulumi/provider-version-action@7c54f136703646f7d6eaa3d3b3c877e5a805d6ab # v1
             with:
               set-env: PROVIDER_VERSION
           - name: Setup tools
@@ -256,7 +256,7 @@ jobs:
             with:
               ref: ${{ env.PR_COMMIT_SHA }}
               submodules: true
-          - uses: pulumi/provider-version-action@v1
+          - uses: pulumi/provider-version-action@7c54f136703646f7d6eaa3d3b3c877e5a805d6ab # v1
             with:
               set-env: PROVIDER_VERSION
           - name: Setup tools
@@ -326,7 +326,7 @@ jobs:
             with:
               ref: ${{ env.PR_COMMIT_SHA }}
               submodules: true
-          - uses: pulumi/provider-version-action@v1
+          - uses: pulumi/provider-version-action@7c54f136703646f7d6eaa3d3b3c877e5a805d6ab # v1
             with:
               set-env: PROVIDER_VERSION
           - name: Setup tools
diff --git a/.github/workflows/upgrade-bridge.yml b/.github/workflows/upgrade-bridge.yml
index 62f8fe2e1e6..e932c504257 100644
--- a/.github/workflows/upgrade-bridge.yml
+++ b/.github/workflows/upgrade-bridge.yml
@@ -82,7 +82,7 @@ jobs:
         tools: pulumictl, pulumicli, nodejs, python, dotnet, go, java
     - name: Call upgrade provider action
       if: github.event_name == 'workflow_dispatch'
-      uses: pulumi/pulumi-upgrade-provider-action@v0.0.12
+      uses: pulumi/pulumi-upgrade-provider-action@a1d9f03fbfd923f787427c1d9e99c2356711d483 # v0.0.13
       with:
         kind: ${{ inputs.kind }}
         email: bot@pulumi.com
@@ -95,7 +95,7 @@ jobs:
         pr-title-prefix: ${{ inputs.pr-title-prefix }}
     - name: Call upgrade provider action
       if: github.event_name == 'repository_dispatch'
-      uses: pulumi/pulumi-upgrade-provider-action@v0.0.12
+      uses: pulumi/pulumi-upgrade-provider-action@a1d9f03fbfd923f787427c1d9e99c2356711d483 # v0.0.13
       with:
         kind: ${{ github.event.client_payload.kind || 'bridge' }}
         email: bot@pulumi.com
diff --git a/provider/go.mod b/provider/go.mod
index f148c4cb860..2f0363a1e68 100644
--- a/provider/go.mod
+++ b/provider/go.mod
@@ -21,8 +21,8 @@ require (
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/pulumi/providertest v0.1.3
 	github.com/pulumi/pulumi-terraform-bridge/v3 v3.96.0
-	github.com/pulumi/pulumi/pkg/v3 v3.140.0
-	github.com/pulumi/pulumi/sdk/v3 v3.140.0
+	github.com/pulumi/pulumi/pkg/v3 v3.142.0
+	github.com/pulumi/pulumi/sdk/v3 v3.142.0
 	github.com/stretchr/testify v1.9.0
 	pgregory.net/rapid v0.6.1
 )
@@ -35,7 +35,7 @@ require (
 replace github.com/hashicorp/terraform-plugin-log => github.com/gdavison/terraform-plugin-log v0.0.0-20230928191232-6c653d8ef8fb
 
 replace (
-	github.com/hashicorp/terraform-plugin-sdk/v2 => github.com/pulumi/terraform-plugin-sdk/v2 v2.0.0-20240520223432-0c0bf0d65f10
+	github.com/hashicorp/terraform-plugin-sdk/v2 => github.com/pulumi/terraform-plugin-sdk/v2 7ac578ce47fc
 	github.com/hashicorp/terraform-provider-aws => ../upstream
 	github.com/hashicorp/vault => github.com/hashicorp/vault v1.2.0
 )
diff --git a/provider/test-programs/ec2-string-for-int/package.json b/provider/test-programs/ec2-string-for-int/package.json
index d72efea056b..b00e67a6aef 100644
--- a/provider/test-programs/ec2-string-for-int/package.json
+++ b/provider/test-programs/ec2-string-for-int/package.json
@@ -5,7 +5,7 @@
         "@types/node": "^18"
     },
     "dependencies": {
-        "@pulumi/aws": "6.33.1",
+        "@pulumi/aws": "6.62.1",
         "@pulumi/awsx": "^2.0.2",
         "@pulumi/pulumi": "^3.113.0",
         "typescript": "^5.0.0"
diff --git a/provider/test-programs/job-queue/package.json b/provider/test-programs/job-queue/package.json
index e64929f6774..d1678ba7b10 100644
--- a/provider/test-programs/job-queue/package.json
+++ b/provider/test-programs/job-queue/package.json
@@ -7,7 +7,7 @@
     },
     "dependencies": {
         "@pulumi/pulumi": "^3.0.0",
-        "@pulumi/aws": "^5.0.0"
+        "@pulumi/aws": "^6.0.0"
     },
     "devDependencies": {
         "@types/node": "^8.0.0"
diff --git a/sdk/go.mod b/sdk/go.mod
index b50ed8ee98d..52c36d3e71a 100644
--- a/sdk/go.mod
+++ b/sdk/go.mod
@@ -4,7 +4,7 @@ go 1.21.12
 
 require (
 	github.com/blang/semver v3.5.1+incompatible
-	github.com/pulumi/pulumi/sdk/v3 v3.140.0
+	github.com/pulumi/pulumi/sdk/v3 v3.142.0
 )
 
 retract (
diff --git a/sdk/go.sum b/sdk/go.sum
index abd9ddf1dca..e5a24c41bdf 100644
--- a/sdk/go.sum
+++ b/sdk/go.sum
@@ -153,6 +153,8 @@ github.com/pulumi/esc v0.9.1 h1:HH5eEv8sgyxSpY5a8yePyqFXzA8cvBvapfH8457+mIs=
 github.com/pulumi/esc v0.9.1/go.mod h1:oEJ6bOsjYlQUpjf70GiX+CXn3VBmpwFDxUTlmtUN84c=
 github.com/pulumi/pulumi/sdk/v3 v3.140.0 h1:+Z/RBvdYg7tBNkBwk4p/FzlV7niBT3TbLAICq/Y0LDU=
 github.com/pulumi/pulumi/sdk/v3 v3.140.0/go.mod h1:PvKsX88co8XuwuPdzolMvew5lZV+4JmZfkeSjj7A6dI=
+github.com/pulumi/pulumi/sdk/v3 v3.142.0 h1:SmcVddGuvwAh3g3XUVQQ5gVRQUKH1yZ6iETpDNHIHlw=
+github.com/pulumi/pulumi/sdk/v3 v3.142.0/go.mod h1:PvKsX88co8XuwuPdzolMvew5lZV+4JmZfkeSjj7A6dI=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=