diff --git a/.github/workflows/apply-benchmark-patch.yml b/.github/workflows/apply-benchmark-patch.yml
index 16b499bea6..83ab29ddf0 100644
--- a/.github/workflows/apply-benchmark-patch.yml
+++ b/.github/workflows/apply-benchmark-patch.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Check out PR branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           ref: ${{ github.event.pull_request.head.ref }}
diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml
index 04046c11d4..ee6f584993 100644
--- a/.github/workflows/cargo-audit.yml
+++ b/.github/workflows/cargo-audit.yml
@@ -10,38 +10,87 @@ concurrency:
   group: cargo-audit-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  actions: read
+
 jobs:
   cargo-audit:
     name: cargo audit
     runs-on: [self-hosted, type-ccx13]
-    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-cargo-audit') }}
     steps:
+      - name: Decide whether to run, skip, or mirror previous result
+        id: gate
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const labels = context.payload.pull_request?.labels?.map(l => l.name) ?? [];
+            if (labels.includes('skip-cargo-audit')) {
+              core.info('skip-cargo-audit label present on PR; skipping audit work.');
+              core.setOutput('skip', 'true');
+              return;
+            }
+
+            const action = context.payload.action;
+            const labelName = context.payload.label?.name;
+            const isLabelEvent = action === 'labeled' || action === 'unlabeled';
+            if (isLabelEvent && labelName !== 'skip-cargo-audit') {
+              const sha = context.payload.pull_request.head.sha;
+              const runs = await github.rest.actions.listWorkflowRuns({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: 'cargo-audit.yml',
+                head_sha: sha,
+                status: 'completed',
+                per_page: 20,
+              });
+              const prev = runs.data.workflow_runs.find(r => r.id !== context.runId);
+              core.info(`Previous completed run for ${sha}: ${prev?.conclusion ?? 'none'}`);
+              if (prev?.conclusion === 'success') {
+                core.setOutput('skip', 'true');
+                return;
+              }
+              if (prev?.conclusion === 'failure') {
+                core.setFailed('Mirroring previous failed run for this commit.');
+                return;
+              }
+            }
+
+            core.setOutput('skip', 'false');
+
       - name: Check-out repositoroy under $GITHUB_WORKSPACE
-        uses: actions/checkout@v4
+        if: steps.gate.outputs.skip != 'true'
+        uses: actions/checkout@v6
 
       - name: Install dependencies
+        if: steps.gate.outputs.skip != 'true'
         run: |
           sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get update
           sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y --no-install-recommends -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" build-essential clang curl libssl-dev llvm libudev-dev protobuf-compiler pkg-config
 
       - name: Install Rust
+        if: steps.gate.outputs.skip != 'true'
         uses: actions-rs/toolchain@v1
         with:
           toolchain: stable
 
       - name: Utilize Shared Rust Cache
+        if: steps.gate.outputs.skip != 'true'
         uses: Swatinem/rust-cache@v2
         with:
           key: cargo-audit
           cache-on-failure: true
 
       - name: Install cargo-audit
+        if: steps.gate.outputs.skip != 'true'
         run: cargo install --force cargo-audit
 
       - name: Display cargo-audit --version
+        if: steps.gate.outputs.skip != 'true'
         run: cargo audit --version
 
       - name: cargo audit
+        if: steps.gate.outputs.skip != 'true'
         run: |
           cargo audit --ignore RUSTSEC-2023-0091 \
                       --ignore RUSTSEC-2024-0438 \
diff --git a/.github/workflows/check-bittensor-e2e-tests.yml b/.github/workflows/check-bittensor-e2e-tests.yml
index bad36f7d9d..c8e4dcbf65 100644
--- a/.github/workflows/check-bittensor-e2e-tests.yml
+++ b/.github/workflows/check-bittensor-e2e-tests.yml
@@ -3,6 +3,7 @@ name: Bittensor Bittensor E2E Test
 permissions:
   pull-requests: write
   contents: read
+  actions: read
 
 concurrency:
   group: e2e-cli-${{ github.ref }}
@@ -28,38 +29,51 @@ jobs:
   check-label:
     runs-on: ubuntu-latest
     outputs:
-      skip-bittensor-e2e-tests: ${{ steps.get-labels.outputs.skip-bittensor-e2e-tests || steps.set-default.outputs.skip-bittensor-e2e-tests }}
+      skip-bittensor-e2e-tests: ${{ steps.decide.outputs.skip-bittensor-e2e-tests }}
+      mirror-skip: ${{ steps.decide.outputs.mirror-skip }}
+      mirror-fail: ${{ steps.decide.outputs.mirror-fail }}
     steps:
-      - name: Install dependencies
-        run: |
-          sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get update
-          sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y --no-install-recommends -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" gh jq
-
-      - name: Check out repository
-        uses: actions/checkout@v4
+      - name: Decide skip / mirror state
+        id: decide
+        uses: actions/github-script@v9
         with:
-          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
-          ref: ${{ github.event.pull_request.head.ref || github.ref_name }}
-
-      - name: Get labels from PR
-        id: get-labels
-        if: github.event_name == 'pull_request'
-        run: |
-          LABELS=$(gh pr -R ${{ github.repository }} view ${{ github.event.pull_request.number }} --json labels --jq '.labels[].name')
-          echo "Current labels: $LABELS"
-          if echo "$LABELS" | grep -q "skip-bittensor-e2e-tests"; then
-            echo "skip-bittensor-e2e-tests=true" >> $GITHUB_OUTPUT
-          else
-            echo "skip-bittensor-e2e-tests=false" >> $GITHUB_OUTPUT
-          fi
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set default skip value for workflow_dispatch
-        id: set-default
-        if: github.event_name == 'workflow_dispatch'
-        run: |
-          echo "skip-bittensor-e2e-tests=false" >> $GITHUB_OUTPUT
+          script: |
+            const eventName = context.eventName;
+            const action = context.payload.action;
+            const labelName = context.payload.label?.name;
+            const isLabelEvent = action === 'labeled' || action === 'unlabeled';
+
+            core.setOutput('skip-bittensor-e2e-tests', 'false');
+            core.setOutput('mirror-skip', 'false');
+            core.setOutput('mirror-fail', 'false');
+
+            if (eventName === 'pull_request') {
+              const labels = context.payload.pull_request?.labels?.map(l => l.name) ?? [];
+              if (labels.includes('skip-bittensor-e2e-tests')) {
+                core.info('skip-bittensor-e2e-tests label present on PR.');
+                core.setOutput('skip-bittensor-e2e-tests', 'true');
+                return;
+              }
+
+              if (isLabelEvent && labelName !== 'skip-bittensor-e2e-tests') {
+                const sha = context.payload.pull_request.head.sha;
+                const runs = await github.rest.actions.listWorkflowRuns({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  workflow_id: 'check-bittensor-e2e-tests.yml',
+                  head_sha: sha,
+                  status: 'completed',
+                  per_page: 20,
+                });
+                const prev = runs.data.workflow_runs.find(r => r.id !== context.runId);
+                core.info(`Previous completed run for ${sha}: ${prev?.conclusion ?? 'none'}`);
+                if (prev?.conclusion === 'success') {
+                  core.setOutput('mirror-skip', 'true');
+                } else if (prev?.conclusion === 'failure') {
+                  core.setOutput('mirror-fail', 'true');
+                }
+              }
+            }
 
   find-btcli-e2e-tests:
     needs: check-label
@@ -82,12 +96,12 @@ jobs:
         run: git checkout staging
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.10'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v8.1.0
         with:
           enable-cache: "false"
 
@@ -142,12 +156,12 @@ jobs:
         run: git checkout staging
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.10'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v8.1.0
         with:
           enable-cache: "false"
 
@@ -198,28 +212,47 @@ jobs:
     runs-on: ${{ matrix.platform.runner }}
 
     steps:
+      - name: Mirror gate
+        id: gate
+        run: |
+          if [ "${{ needs.check-label.outputs.mirror-fail }}" = "true" ]; then
+            echo "Mirroring previous failed run for this commit."
+            exit 1
+          fi
+          if [ "${{ needs.check-label.outputs.mirror-skip }}" = "true" ]; then
+            echo "Mirroring previous successful run for this commit."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Checkout code
-        uses: actions/checkout@v4
+        if: steps.gate.outputs.skip != 'true'
+        uses: actions/checkout@v6
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
           ref: ${{ github.event.pull_request.head.ref || github.ref_name }}
 
       - name: Install Rust + dependencies
+        if: steps.gate.outputs.skip != 'true'
         run: |
           chmod +x ./scripts/install_build_env.sh
           ./scripts/install_build_env.sh
 
       - name: Add Rust target triple
+        if: steps.gate.outputs.skip != 'true'
         run: |
           source "$HOME/.cargo/env"
           rustup target add ${{ matrix.platform.triple }}
 
       - name: Patch limits for local run
+        if: steps.gate.outputs.skip != 'true'
         run: |
           chmod +x ./scripts/localnet_patch.sh
           ./scripts/localnet_patch.sh
 
       - name: Build binaries
+        if: steps.gate.outputs.skip != 'true'
         run: |
           export PATH="$HOME/.cargo/bin:$PATH"
           export CARGO_BUILD_TARGET="${{ matrix.platform.triple }}"
@@ -232,6 +265,7 @@ jobs:
 
       # use `ci_target` name bc .dockerignore excludes `target`
       - name: Prepare artifacts for upload
+        if: steps.gate.outputs.skip != 'true'
         run: |
           RUNTIME="${{ matrix.runtime }}"
           TRIPLE="${{ matrix.platform.triple }}"
@@ -259,7 +293,8 @@ jobs:
             build/ci_target/${RUNTIME}/${TRIPLE}/release/wbuild/node-subtensor-runtime/
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        if: steps.gate.outputs.skip != 'true'
+        uses: actions/upload-artifact@v7
         with:
           name: binaries-${{ matrix.platform.triple }}-${{ matrix.runtime }}
           path: build/
@@ -271,20 +306,37 @@ jobs:
     if: needs.check-label.outputs.skip-bittensor-e2e-tests == 'false'
     runs-on: ubuntu-latest
     steps:
+      - name: Mirror gate
+        id: gate
+        run: |
+          if [ "${{ needs.check-label.outputs.mirror-fail }}" = "true" ]; then
+            echo "Mirroring previous failed run for this commit."
+            exit 1
+          fi
+          if [ "${{ needs.check-label.outputs.mirror-skip }}" = "true" ]; then
+            echo "Mirroring previous successful run for this commit."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Checkout code
-        uses: actions/checkout@v4
+        if: steps.gate.outputs.skip != 'true'
+        uses: actions/checkout@v6
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
           ref: ${{ github.event.pull_request.head.ref || github.ref_name }}
 
       - name: Download all binary artifacts
-        uses: actions/download-artifact@v5
+        if: steps.gate.outputs.skip != 'true'
+        uses: actions/download-artifact@v8
         with:
           pattern: binaries-*
           path: build/
           merge-multiple: true
 
       - name: Move Docker data-root to /mnt/data
+        if: steps.gate.outputs.skip != 'true'
         run: |
           sudo systemctl stop docker
           sudo mkdir -p /mnt/data/docker
@@ -295,13 +347,16 @@ jobs:
           docker info | grep "Docker Root Dir"
 
       - name: Build Docker Image
+        if: steps.gate.outputs.skip != 'true'
         run: docker build -f Dockerfile-localnet --build-arg BUILT_IN_CI="Boom shakalaka" -t localnet .
 
       - name: Save Docker Image as Tar
+        if: steps.gate.outputs.skip != 'true'
         run: docker save -o /mnt/data/subtensor-localnet.tar localnet
 
       - name: Upload Docker Image as Artifact
-        uses: actions/upload-artifact@v4
+        if: steps.gate.outputs.skip != 'true'
+        uses: actions/upload-artifact@v7
         with:
           name: subtensor-localnet
           path: /mnt/data/subtensor-localnet.tar
@@ -323,26 +378,45 @@ jobs:
     timeout-minutes: 60
     name: "cli: ${{ matrix.label }}"
     steps:
+      - name: Mirror gate
+        id: gate
+        run: |
+          if [ "${{ needs.check-label.outputs.mirror-fail }}" = "true" ]; then
+            echo "Mirroring previous failed run for this commit."
+            exit 1
+          fi
+          if [ "${{ needs.check-label.outputs.mirror-skip }}" = "true" ]; then
+            echo "Mirroring previous successful run for this commit."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Check-out repository
-        uses: actions/checkout@v4
+        if: steps.gate.outputs.skip != 'true'
+        uses: actions/checkout@v6
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
           ref: ${{ github.event.pull_request.head.ref || github.ref_name }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        if: steps.gate.outputs.skip != 'true'
+        uses: astral-sh/setup-uv@v8.1.0
         with:
           enable-cache: "false"
 
       - name: Create Python virtual environment
+        if: steps.gate.outputs.skip != 'true'
         working-directory: ${{ github.workspace }}
         run: uv venv --seed ${{ github.workspace }}/venv
 
       - name: Clone Bittensor CLI repo
+        if: steps.gate.outputs.skip != 'true'
         working-directory: ${{ github.workspace }}
         run: git clone https://github.com/opentensor/btcli.git
 
       - name: Setup Bittensor-cli from cloned repo
+        if: steps.gate.outputs.skip != 'true'
         working-directory: ${{ github.workspace }}/btcli
         run: |
           source ${{ github.workspace }}/venv/bin/activate
@@ -353,17 +427,21 @@ jobs:
           uv run --active pip install pytest
 
       - name: Download Cached Docker Image
-        uses: actions/download-artifact@v4
+        if: steps.gate.outputs.skip != 'true'
+        uses: actions/download-artifact@v8
         with:
           name: subtensor-localnet
 
       - name: Load Docker Image
+        if: steps.gate.outputs.skip != 'true'
         run: docker load -i subtensor-localnet.tar
 
       - name: Retag Docker Image
+        if: steps.gate.outputs.skip != 'true'
         run: docker tag localnet ghcr.io/opentensor/subtensor-localnet:devnet-ready
 
       - name: Run with retry
+        if: steps.gate.outputs.skip != 'true'
         working-directory: ${{ github.workspace }}/btcli
         run: |
           source ${{ github.workspace }}/venv/bin/activate
@@ -404,26 +482,45 @@ jobs:
     timeout-minutes: 60
     name: "sdk: ${{ matrix.label }}"
     steps:
+      - name: Mirror gate
+        id: gate
+        run: |
+          if [ "${{ needs.check-label.outputs.mirror-fail }}" = "true" ]; then
+            echo "Mirroring previous failed run for this commit."
+            exit 1
+          fi
+          if [ "${{ needs.check-label.outputs.mirror-skip }}" = "true" ]; then
+            echo "Mirroring previous successful run for this commit."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Check-out repository
-        uses: actions/checkout@v4
+        if: steps.gate.outputs.skip != 'true'
+        uses: actions/checkout@v6
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
           ref: ${{ github.event.pull_request.head.ref || github.ref_name }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        if: steps.gate.outputs.skip != 'true'
+        uses: astral-sh/setup-uv@v8.1.0
         with:
           enable-cache: "false"
 
       - name: Create Python virtual environment
+        if: steps.gate.outputs.skip != 'true'
         working-directory: ${{ github.workspace }}
         run: uv venv --seed ${{ github.workspace }}/venv
 
       - name: Clone Bittensor SDK repo
+        if: steps.gate.outputs.skip != 'true'
         working-directory: ${{ github.workspace }}
         run: git clone https://github.com/opentensor/bittensor.git
 
       - name: Setup Bittensor SDK from cloned repo
+        if: steps.gate.outputs.skip != 'true'
         working-directory: ${{ github.workspace }}/bittensor
         run: |
           source ${{ github.workspace }}/venv/bin/activate
@@ -434,17 +531,21 @@ jobs:
           uv run --active pip install pytest
 
       - name: Download Cached Docker Image
-        uses: actions/download-artifact@v4
+        if: steps.gate.outputs.skip != 'true'
+        uses: actions/download-artifact@v8
         with:
           name: subtensor-localnet
 
       - name: Load Docker Image
+        if: steps.gate.outputs.skip != 'true'
         run: docker load -i subtensor-localnet.tar
 
       - name: Retag Docker Image
+        if: steps.gate.outputs.skip != 'true'
         run: docker tag localnet ghcr.io/opentensor/subtensor-localnet:devnet-ready
 
       - name: Run with retry
+        if: steps.gate.outputs.skip != 'true'
         working-directory: ${{ github.workspace }}/bittensor
         run: |
           source ${{ github.workspace }}/venv/bin/activate
diff --git a/.github/workflows/check-devnet.yml b/.github/workflows/check-devnet.yml
index 8d3db55001..445cf6e44a 100644
--- a/.github/workflows/check-devnet.yml
+++ b/.github/workflows/check-devnet.yml
@@ -4,11 +4,15 @@ on:
   pull_request:
     branches: [devnet, devnet-ready]
     types: [labeled, unlabeled, synchronize, opened]
-    
+
 concurrency:
   group: check-devnet-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  actions: read
+
 env:
   CARGO_TERM_COLOR: always
 
@@ -16,22 +20,64 @@ jobs:
   check-spec-version:
     name: Check spec_version bump
     runs-on: [self-hosted, type-ccx33]
-    if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-spec-version-bump') }}
     steps:
+      - name: Decide whether to run, skip, or mirror previous result
+        id: gate
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const labels = context.payload.pull_request?.labels?.map(l => l.name) ?? [];
+            if (labels.includes('no-spec-version-bump')) {
+              core.info('no-spec-version-bump label present on PR; skipping spec_version check.');
+              core.setOutput('skip', 'true');
+              return;
+            }
+
+            const action = context.payload.action;
+            const labelName = context.payload.label?.name;
+            const isLabelEvent = action === 'labeled' || action === 'unlabeled';
+            if (isLabelEvent && labelName !== 'no-spec-version-bump') {
+              const sha = context.payload.pull_request.head.sha;
+              const runs = await github.rest.actions.listWorkflowRuns({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: 'check-devnet.yml',
+                head_sha: sha,
+                status: 'completed',
+                per_page: 20,
+              });
+              const prev = runs.data.workflow_runs.find(r => r.id !== context.runId);
+              core.info(`Previous completed run for ${sha}: ${prev?.conclusion ?? 'none'}`);
+              if (prev?.conclusion === 'success') {
+                core.setOutput('skip', 'true');
+                return;
+              }
+              if (prev?.conclusion === 'failure') {
+                core.setFailed('Mirroring previous failed run for this commit.');
+                return;
+              }
+            }
+
+            core.setOutput('skip', 'false');
+
       - name: Dependencies
+        if: steps.gate.outputs.skip != 'true'
         run: |
           sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get update
           sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y --no-install-recommends -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" build-essential clang curl libssl-dev llvm libudev-dev protobuf-compiler pkg-config
 
       - name: Install Rust
+        if: steps.gate.outputs.skip != 'true'
         uses: actions-rs/toolchain@v1
         with:
           toolchain: stable
 
       - name: Check-out repository under $GITHUB_WORKSPACE
-        uses: actions/checkout@v4
+        if: steps.gate.outputs.skip != 'true'
+        uses: actions/checkout@v6
 
       - name: Utilize Shared Rust Cache
+        if: steps.gate.outputs.skip != 'true'
         uses: Swatinem/rust-cache@v2
         with:
           key: try-runtime
@@ -39,9 +85,11 @@ jobs:
           save-if: true
 
       - name: Install substrate-spec-version
+        if: steps.gate.outputs.skip != 'true'
         run: cargo install substrate-spec-version
 
       - name: Check that spec_version has been bumped
+        if: steps.gate.outputs.skip != 'true'
         run: |
           spec_version=$(PATH=$PATH:$HOME/.cargo/.bin substrate-spec-version wss://dev.chain.opentensor.ai:443 | tr -d '\n')
           echo "network spec_version: $spec_version"
diff --git a/.github/workflows/check-docker.yml b/.github/workflows/check-docker.yml
index da5054fd6d..d6d820492e 100644
--- a/.github/workflows/check-docker.yml
+++ b/.github/workflows/check-docker.yml
@@ -13,13 +13,13 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v4.1.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v4.1.0
 
       - name: Build Docker Image
         run: docker build .
diff --git a/.github/workflows/check-finney.yml b/.github/workflows/check-finney.yml
index 6b056ef97e..3c2169d155 100644
--- a/.github/workflows/check-finney.yml
+++ b/.github/workflows/check-finney.yml
@@ -4,11 +4,15 @@ on:
   pull_request:
     branches: [finney, main]
     types: [labeled, unlabeled, synchronize, opened]
-    
+
 concurrency:
   group: check-finney-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  actions: read
+
 env:
   CARGO_TERM_COLOR: always
 
@@ -16,30 +20,74 @@ jobs:
   check-spec-version:
     name: Check spec_version bump
     runs-on: [self-hosted, type-ccx33]
-    if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-spec-version-bump') }}
     steps:
+      - name: Decide whether to run, skip, or mirror previous result
+        id: gate
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const labels = context.payload.pull_request?.labels?.map(l => l.name) ?? [];
+            if (labels.includes('no-spec-version-bump')) {
+              core.info('no-spec-version-bump label present on PR; skipping spec_version check.');
+              core.setOutput('skip', 'true');
+              return;
+            }
+
+            const action = context.payload.action;
+            const labelName = context.payload.label?.name;
+            const isLabelEvent = action === 'labeled' || action === 'unlabeled';
+            if (isLabelEvent && labelName !== 'no-spec-version-bump') {
+              const sha = context.payload.pull_request.head.sha;
+              const runs = await github.rest.actions.listWorkflowRuns({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: 'check-finney.yml',
+                head_sha: sha,
+                status: 'completed',
+                per_page: 20,
+              });
+              const prev = runs.data.workflow_runs.find(r => r.id !== context.runId);
+              core.info(`Previous completed run for ${sha}: ${prev?.conclusion ?? 'none'}`);
+              if (prev?.conclusion === 'success') {
+                core.setOutput('skip', 'true');
+                return;
+              }
+              if (prev?.conclusion === 'failure') {
+                core.setFailed('Mirroring previous failed run for this commit.');
+                return;
+              }
+            }
+
+            core.setOutput('skip', 'false');
+
       - name: Dependencies
+        if: steps.gate.outputs.skip != 'true'
         run: |
           sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get update
           sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y --no-install-recommends -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" build-essential clang curl libssl-dev llvm libudev-dev protobuf-compiler pkg-config
 
       - name: Install Rust
+        if: steps.gate.outputs.skip != 'true'
         uses: actions-rs/toolchain@v1
         with:
           toolchain: stable
 
       - name: Check-out repository under $GITHUB_WORKSPACE
-        uses: actions/checkout@v4
+        if: steps.gate.outputs.skip != 'true'
+        uses: actions/checkout@v6
 
       - name: Utilize Shared Rust Cache
+        if: steps.gate.outputs.skip != 'true'
         uses: Swatinem/rust-cache@v2
         with:
           key: try-runtime
 
       - name: Install substrate-spec-version
+        if: steps.gate.outputs.skip != 'true'
         run: cargo install substrate-spec-version
 
       - name: Check that spec_version has been bumped
+        if: steps.gate.outputs.skip != 'true'
         run: |
           spec_version=$(PATH=$PATH:$HOME/.cargo/.bin substrate-spec-version wss://entrypoint-finney.opentensor.ai:443 | tr -d '\n')
           echo "network spec_version: $spec_version"
diff --git a/.github/workflows/check-node-compat.yml b/.github/workflows/check-node-compat.yml
index b52a7a88ba..e9b2bfb64c 100644
--- a/.github/workflows/check-node-compat.yml
+++ b/.github/workflows/check-node-compat.yml
@@ -16,14 +16,16 @@ jobs:
   build:
     name: build ${{ matrix.version.name }}
     runs-on: [self-hosted, type-ccx33]
-    if: contains(github.event.pull_request.labels.*.name, 'check-node-compat')
+    if: github.event.label.name == 'check-node-compat'
     env:
         RUST_BACKTRACE: full
     strategy:
       matrix:
         version:
-          - { name: old, ref: devnet-ready }
-          - { name: new, ref: ${{ github.head_ref }} }
+          - name: old
+            ref: devnet-ready
+          - name: new
+            ref: ${{ github.head_ref }}
 
     steps:
       - name: Install dependencies
@@ -42,7 +44,7 @@ jobs:
           key: "check-node-compat-${{ matrix.version.name }}"
       
       - name: Checkout ${{ matrix.version.name }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ matrix.version.ref }}
           path: ${{ matrix.version.name }}
@@ -52,7 +54,7 @@ jobs:
         run: cargo build --release --locked
         
       - name: Upload ${{ matrix.version.name }} node binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: node-subtensor-${{ matrix.version.name }}
           path: ${{ matrix.version.name }}/target/release/node-subtensor
@@ -63,19 +65,19 @@ jobs:
     runs-on: [self-hosted, type-ccx33]
     steps:
       - name: Download old node binary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: node-subtensor-old
           path: /tmp/node-subtensor-old
           
       - name: Download new node binary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: node-subtensor-new
           path: /tmp/node-subtensor-new
           
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "24"
 
diff --git a/.github/workflows/check-rust.yml b/.github/workflows/check-rust.yml
index 4b975959d0..62db67379a 100644
--- a/.github/workflows/check-rust.yml
+++ b/.github/workflows/check-rust.yml
@@ -28,7 +28,7 @@ jobs:
       RUST_BACKTRACE: full
     steps:
       - name: Check-out repository under $GITHUB_WORKSPACE
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: |
@@ -73,7 +73,7 @@ jobs:
       SKIP_WASM_BUILD: 1
     steps:
       - name: Check-out repository under $GITHUB_WORKSPACE
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: |
@@ -104,7 +104,7 @@ jobs:
       SKIP_WASM_BUILD: 1
     steps:
       - name: Check-out repository under $GITHUB_WORKSPACE
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: |
@@ -136,7 +136,7 @@ jobs:
       SKIP_WASM_BUILD: 1
     steps:
       - name: Check-out repository under $GITHUB_WORKSPACE
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: |
@@ -167,7 +167,7 @@ jobs:
       SKIP_WASM_BUILD: 1
     steps:
       - name: Check-out repository under $GITHUB_WORKSPACE
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: |
@@ -197,7 +197,7 @@ jobs:
       SKIP_WASM_BUILD: 1
     steps:
       - name: Check-out repository under $GITHUB_WORKSPACE
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: |
@@ -234,7 +234,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0 # Dont clone historic commits.
 
diff --git a/.github/workflows/check-testnet.yml b/.github/workflows/check-testnet.yml
index 219d99051f..60639428b9 100644
--- a/.github/workflows/check-testnet.yml
+++ b/.github/workflows/check-testnet.yml
@@ -9,6 +9,10 @@ concurrency:
   group: check-testnet-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  actions: read
+
 env:
   CARGO_TERM_COLOR: always
 
@@ -16,31 +20,75 @@ jobs:
   check-spec-version:
     name: Check spec_version bump
     runs-on: [self-hosted, type-ccx33]
-    if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-spec-version-bump') }}
     steps:
+      - name: Decide whether to run, skip, or mirror previous result
+        id: gate
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const labels = context.payload.pull_request?.labels?.map(l => l.name) ?? [];
+            if (labels.includes('no-spec-version-bump')) {
+              core.info('no-spec-version-bump label present on PR; skipping spec_version check.');
+              core.setOutput('skip', 'true');
+              return;
+            }
+
+            const action = context.payload.action;
+            const labelName = context.payload.label?.name;
+            const isLabelEvent = action === 'labeled' || action === 'unlabeled';
+            if (isLabelEvent && labelName !== 'no-spec-version-bump') {
+              const sha = context.payload.pull_request.head.sha;
+              const runs = await github.rest.actions.listWorkflowRuns({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: 'check-testnet.yml',
+                head_sha: sha,
+                status: 'completed',
+                per_page: 20,
+              });
+              const prev = runs.data.workflow_runs.find(r => r.id !== context.runId);
+              core.info(`Previous completed run for ${sha}: ${prev?.conclusion ?? 'none'}`);
+              if (prev?.conclusion === 'success') {
+                core.setOutput('skip', 'true');
+                return;
+              }
+              if (prev?.conclusion === 'failure') {
+                core.setFailed('Mirroring previous failed run for this commit.');
+                return;
+              }
+            }
+
+            core.setOutput('skip', 'false');
+
       - name: Dependencies
+        if: steps.gate.outputs.skip != 'true'
         run: |
           sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get update
           sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y --no-install-recommends -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" build-essential clang curl libssl-dev llvm libudev-dev protobuf-compiler pkg-config
 
       - name: Install Rust
+        if: steps.gate.outputs.skip != 'true'
         uses: actions-rs/toolchain@v1
         with:
           toolchain: stable
 
       - name: Check-out repository under $GITHUB_WORKSPACE
-        uses: actions/checkout@v4
+        if: steps.gate.outputs.skip != 'true'
+        uses: actions/checkout@v6
 
       - name: Utilize Shared Rust Cache
+        if: steps.gate.outputs.skip != 'true'
         uses: Swatinem/rust-cache@v2
         with:
           key: try-runtime
           cache-on-failure: true
 
       - name: Install substrate-spec-version
+        if: steps.gate.outputs.skip != 'true'
         run: cargo install substrate-spec-version
 
       - name: Check that spec_version has been bumped
+        if: steps.gate.outputs.skip != 'true'
         run: |
           spec_version=$(PATH=$PATH:$HOME/.cargo/.bin substrate-spec-version wss://test.finney.opentensor.ai:443 | tr -d '\n')
           echo "network spec_version: $spec_version"
diff --git a/.github/workflows/contract-tests.yml b/.github/workflows/contract-tests.yml
index d524af0c64..363f8355b6 100644
--- a/.github/workflows/contract-tests.yml
+++ b/.github/workflows/contract-tests.yml
@@ -29,9 +29,11 @@ jobs:
       RUST_BACKTRACE: full
     steps:
       - name: Check-out repository under $GITHUB_WORKSPACE
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install Rust
+        # This has been archived since Oct 2023, might be a good idea to eventually switch to
+        # https://github.com/marketplace/actions/rustup-toolchain-install
         uses: actions-rs/toolchain@v1
         with:
           toolchain: stable
@@ -40,7 +42,7 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "22"
 
diff --git a/.github/workflows/docker-localnet.yml b/.github/workflows/docker-localnet.yml
index 2218e886ea..8a9b5ddc9b 100644
--- a/.github/workflows/docker-localnet.yml
+++ b/.github/workflows/docker-localnet.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Get PR branch (if pr-number is specified)
         id: pr-info
         if: ${{ github.event.inputs.pr-number != '' }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const prNumber = '${{ github.event.inputs.pr-number }}';
@@ -108,7 +108,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ needs.setup.outputs.ref }}
 
@@ -153,7 +153,7 @@ jobs:
             build/ci_target/${RUNTIME}/${TRIPLE}/release/wbuild/node-subtensor-runtime/
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: binaries-${{ matrix.platform.triple }}-${{ matrix.runtime }}
           path: build/
@@ -169,12 +169,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ needs.setup.outputs.ref }}
 
       - name: Download all binary artifacts
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
         with:
           pattern: binaries-*
           path: build/
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index a60f0f9d82..a22a8d71af 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -46,7 +46,7 @@ jobs:
           fi
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ env.ref }}
 
diff --git a/.github/workflows/eco-tests.yml b/.github/workflows/eco-tests.yml
index f5413f45cc..8d5c01a014 100644
--- a/.github/workflows/eco-tests.yml
+++ b/.github/workflows/eco-tests.yml
@@ -23,7 +23,7 @@ jobs:
       SKIP_WASM_BUILD: 1
     steps:
       - name: Check-out repository under $GITHUB_WORKSPACE
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: |
diff --git a/.github/workflows/label-triggers.yml b/.github/workflows/label-triggers.yml
index 8c7803b2e3..b6abc2e8e1 100644
--- a/.github/workflows/label-triggers.yml
+++ b/.github/workflows/label-triggers.yml
@@ -17,7 +17,7 @@ jobs:
     steps:
       - name: Check if 'breaking change' label is added
         if: github.event.label.name == 'breaking-change'
-        uses: actions/github-script@v6
+        uses: actions/github-script@v9
         with:
           script: |
             github.rest.issues.createComment({
diff --git a/.github/workflows/require-clean-merges.yml b/.github/workflows/require-clean-merges.yml
index dd7a8829e7..fca628dfc6 100644
--- a/.github/workflows/require-clean-merges.yml
+++ b/.github/workflows/require-clean-merges.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: [self-hosted, type-ccx13]
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0 # Ensures we get all branches for merging
 
diff --git a/.github/workflows/run-benchmarks.yml b/.github/workflows/run-benchmarks.yml
index 0e3dea9dc1..09d1c9983e 100644
--- a/.github/workflows/run-benchmarks.yml
+++ b/.github/workflows/run-benchmarks.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Check out PR branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           ref: ${{ github.event.pull_request.head.ref }}
@@ -75,7 +75,7 @@ jobs:
 
       - name: Upload patch artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: bench-patch
           path: bench-patch.tgz
diff --git a/.github/workflows/rustdocs.yml b/.github/workflows/rustdocs.yml
index 5b3b1d5baf..e462a38206 100644
--- a/.github/workflows/rustdocs.yml
+++ b/.github/workflows/rustdocs.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: |
@@ -48,7 +48,7 @@ jobs:
         run: |
             echo "<meta http-equiv=refresh content=0;url=wasm_oidc_plugin/index.html>" > target/doc/index.html
       - name: Upload documentation
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
             path: ./target/doc
 
@@ -66,4 +66,4 @@ jobs:
         steps:
           - name: Deploy documentation
             id: pages
-            uses: actions/deploy-pages@v2
+            uses: actions/deploy-pages@v5
diff --git a/.github/workflows/scheduled-smoke-tests.yml b/.github/workflows/scheduled-smoke-tests.yml
index 3293de177b..9bbd92983c 100644
--- a/.github/workflows/scheduled-smoke-tests.yml
+++ b/.github/workflows/scheduled-smoke-tests.yml
@@ -26,10 +26,10 @@ jobs:
 
     steps:
       - name: Check-out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: ts-tests/.nvmrc
 
diff --git a/.github/workflows/try-runtime.yml b/.github/workflows/try-runtime.yml
index 98fa613d6a..0fdd0d8f87 100644
--- a/.github/workflows/try-runtime.yml
+++ b/.github/workflows/try-runtime.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: [self-hosted, type-ccx33]
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: |
@@ -48,7 +48,7 @@ jobs:
     runs-on: [self-hosted, type-ccx33]
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: |
@@ -79,7 +79,7 @@ jobs:
     runs-on: [self-hosted, type-ccx33]
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: |
diff --git a/.github/workflows/typescript-e2e.yml b/.github/workflows/typescript-e2e.yml
index 82c63e1356..caa1138bc8 100644
--- a/.github/workflows/typescript-e2e.yml
+++ b/.github/workflows/typescript-e2e.yml
@@ -14,15 +14,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check-out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6.0.8
         with:
           version: 10
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: ts-tests/.nvmrc
 
@@ -58,7 +58,7 @@ jobs:
       RUST_BACKTRACE: full
     steps:
       - name: Check-out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install system dependencies
         run: |
@@ -82,7 +82,7 @@ jobs:
         run: cargo build --profile release ${{ matrix.flags }} -p node-subtensor
 
       - name: Upload binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: node-subtensor-${{ matrix.variant }}
           path: target/release/node-subtensor
@@ -112,10 +112,10 @@ jobs:
 
     steps:
       - name: Check-out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Download binary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: node-subtensor-${{ matrix.binary }}
           path: target/release
@@ -124,7 +124,7 @@ jobs:
         run: chmod +x target/release/node-subtensor
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: ts-tests/.nvmrc
 
diff --git a/.github/workflows/update-chainspec.yml b/.github/workflows/update-chainspec.yml
index ad7f0fc943..b572e8f74b 100644
--- a/.github/workflows/update-chainspec.yml
+++ b/.github/workflows/update-chainspec.yml
@@ -31,7 +31,7 @@ jobs:
       RUST_BACKTRACE: full
     steps:
       - name: Check-out repository under $GITHUB_WORKSPACE
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: |