diff --git a/.github/workflows/cross-repo-links.yml b/.github/workflows/cross-repo-links.yml
index ae6bacc..fcb8c50 100644
--- a/.github/workflows/cross-repo-links.yml
+++ b/.github/workflows/cross-repo-links.yml
@@ -33,7 +33,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/docs-acceptance.yml b/.github/workflows/docs-acceptance.yml
index c724f81..ff1168f 100644
--- a/.github/workflows/docs-acceptance.yml
+++ b/.github/workflows/docs-acceptance.yml
@@ -49,7 +49,7 @@ jobs:
           persist-credentials: false
           path: policy
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/docs-check.yml b/.github/workflows/docs-check.yml
index 2ff231b..b2a4a4e 100644
--- a/.github/workflows/docs-check.yml
+++ b/.github/workflows/docs-check.yml
@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       # The checker runs before the tests because a rule that stopped working
diff --git a/.github/workflows/secret-scan-tests.yml b/.github/workflows/secret-scan-tests.yml
index 6c1b6d2..530f407 100644
--- a/.github/workflows/secret-scan-tests.yml
+++ b/.github/workflows/secret-scan-tests.yml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           persist-credentials: false
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12'
       - name: Install checksum-verified Gitleaks