diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bf87ce9..d843d74 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -81,7 +81,7 @@ jobs:
           path: _common_ci
       - run: mv _common_ci ../common
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.25'
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 087f754..97dec02 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -33,16 +33,16 @@ jobs:
         with:
           repository: InstaNode-dev/proto
           path: proto
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: provisioner/go.mod
-      - uses: github/codeql-action/init@v4
+      - uses: github/codeql-action/init@v4.37.4
         with:
           languages: go
           queries: security-extended
       - name: Build
         working-directory: provisioner
         run: go build ./...
-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/analyze@v4.37.4
         with:
           category: "/language:go"
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 72598a1..8f963ad 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -166,7 +166,7 @@ jobs:
           repository: InstaNode-dev/proto
           path: proto
         continue-on-error: true
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: provisioner/go.mod
       # Drop the `|| true` from the previous revision — it masked real test
@@ -232,7 +232,7 @@ jobs:
       # covered by a test (100%), and the project floor stays >=95%.
       # Tool: diff-cover (https://github.com/Bachmann1234/diff-cover).
       # ------------------------------------------------------------------
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         if: github.event_name == 'pull_request'
         with:
           python-version: '3.12'
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 1c92718..666581e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -96,7 +96,7 @@ jobs:
           echo "Built ${VERSION} (${BUILD_TIME})"
 
       - name: Set up Go (for unit tests + go.mod replace directives)
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: '1.25'
 
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index c4c8088..250212a 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -34,7 +34,7 @@ jobs:
           repository: InstaNode-dev/proto
           path: proto
         continue-on-error: true
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: provisioner/go.mod
       - uses: golangci/golangci-lint-action@v9
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 77fe4dd..5014ab8 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -30,7 +30,7 @@ jobs:
         with:
           repository: InstaNode-dev/proto
           path: proto
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: provisioner/go.mod
           check-latest: true