diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index e4006eb..edc149a 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -25,7 +25,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           # The newest 1.27 patch release: go.mod's go line is only the
           # floor, and standard-library fixes ship in patch releases.
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index f0a6d8c..5cb8f20 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -20,7 +20,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.27'
           check-latest: true
@@ -57,7 +57,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.27'
           check-latest: true
diff --git a/.github/workflows/semantic_analysis.yml b/.github/workflows/semantic_analysis.yml
index eaf446b..47a3cd0 100644
--- a/.github/workflows/semantic_analysis.yml
+++ b/.github/workflows/semantic_analysis.yml
@@ -22,7 +22,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           # The newest 1.27 patch release, at least what go.mod requires: sfw
           # runs the loader with GOTOOLCHAIN=local, so an older toolchain
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 79c95eb..8ef9e92 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -20,7 +20,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           # The newest 1.27 patch release: go.mod's go line is only the
           # floor, and standard-library fixes ship in patch releases.
@@ -50,7 +50,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           # The newest 1.27 patch release: go.mod's go line is only the
           # floor, and standard-library fixes ship in patch releases.
diff --git a/action.yml b/action.yml
index 23785c7..4b6739f 100644
--- a/action.yml
+++ b/action.yml
@@ -90,7 +90,7 @@ runs:
   using: 'composite'
   steps:
     - name: Set up Go
-      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: ${{ inputs.go-version }}