diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index 70da17e1..df0f667d 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -61,7 +61,7 @@ jobs:
       - name: Set up Python
         id: setup_python
         continue-on-error: true
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
           cache: pip
@@ -76,7 +76,7 @@ jobs:
 
       - name: Set up Python (retry)
         if: steps.setup_python.outcome == 'failure'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
           cache: pip
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e3583c08..daec680f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -134,7 +134,7 @@ jobs:
       - name: Set up Python
         id: setup_python
         continue-on-error: true
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
@@ -147,7 +147,7 @@ jobs:
 
       - name: Set up Python (retry)
         if: steps.setup_python.outcome == 'failure'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
@@ -209,7 +209,7 @@ jobs:
       - name: Set up Python
         id: setup_python
         continue-on-error: true
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
@@ -222,7 +222,7 @@ jobs:
 
       - name: Set up Python (retry)
         if: steps.setup_python.outcome == 'failure'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
@@ -470,7 +470,7 @@ jobs:
       - name: Set up Python
         id: setup_python
         continue-on-error: true
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
@@ -485,7 +485,7 @@ jobs:
 
       - name: Set up Python (retry)
         if: steps.setup_python.outcome == 'failure'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a0cf9ff3..3112d97b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -165,7 +165,7 @@ jobs:
       - name: Set up Python
         id: setup_python
         continue-on-error: true
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Wait before Python retry
@@ -176,7 +176,7 @@ jobs:
           sleep 30
       - name: Set up Python (retry)
         if: steps.setup_python.outcome == 'failure'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Sync root README into bindings/python so it ships with the wheel
diff --git a/.github/workflows/sync-metadata.yml b/.github/workflows/sync-metadata.yml
index 8c49d4a4..131ea09f 100644
--- a/.github/workflows/sync-metadata.yml
+++ b/.github/workflows/sync-metadata.yml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - name: Audit repo-metadata.toml drift