diff --git a/.github/workflows/authcontract-gate.yml b/.github/workflows/authcontract-gate.yml
index b2591e3..e8e3874 100644
--- a/.github/workflows/authcontract-gate.yml
+++ b/.github/workflows/authcontract-gate.yml
@@ -38,7 +38,7 @@ jobs:
       - name: Fetch current base
         run: git fetch origin "${{ github.event.pull_request.base.ref }}"
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8483c24..ff9c54f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
         python-version: ["3.10", "3.12"]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
       # The no-network reinstall later in `make ci` must find the declared build backend
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 57cd406..c2aa228 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - name: Install the auditor at a pinned version