diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ace0f2e4..c663b3c5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -140,7 +140,7 @@ jobs:
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.13"
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: tools/gitleaks/go.mod
           # The scanner binary is built here, so a restored build cache would be
diff --git a/.github/workflows/gitleaks-history.yml b/.github/workflows/gitleaks-history.yml
index b3c3c984..410c41ea 100644
--- a/.github/workflows/gitleaks-history.yml
+++ b/.github/workflows/gitleaks-history.yml
@@ -23,7 +23,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: tools/gitleaks/go.mod
           # The scanner binary is built here, so a restored build cache would be
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 6310605c..013ac2ec 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -32,7 +32,7 @@ jobs:
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.11"
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: tools/gitleaks/go.mod
           # The scanner binary is built here, so a restored build cache would be