diff --git a/.github/workflows/app-build-verify.yml b/.github/workflows/app-build-verify.yml
index 813951d1..02d9c238 100644
--- a/.github/workflows/app-build-verify.yml
+++ b/.github/workflows/app-build-verify.yml
@@ -146,7 +146,7 @@ jobs:
       # fall back to the system-provided Python package. Providing "system" as a value
       # on macOS or Windows will cause an error.
       if: ${{ !startsWith(inputs.runner-os, 'ubuntu') || inputs.python-version != 'system' }}
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         # This needs to be kept aligned with the input default value
         python-version: ${{ inputs.python-version || '3.13' }}
diff --git a/.github/workflows/app-create-verify.yml b/.github/workflows/app-create-verify.yml
index 21c17564..310865a9 100644
--- a/.github/workflows/app-create-verify.yml
+++ b/.github/workflows/app-create-verify.yml
@@ -83,7 +83,7 @@ jobs:
       # Python matching the system version. We can't use the actual system
       # install because we need to install dependencies, which would either
       # require the use of sudo, or extra workarounds for user-space packages.
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: ${{ startsWith(inputs.runner-os, 'ubuntu') && inputs.python-version == 'system' && steps.config.outputs.system-python-version || inputs.python-version || '3.x' }}
         cache: pip
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0543895f..02f04ef3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -116,7 +116,7 @@ jobs:
         persist-credentials: false
 
     - name: Set up Python
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: "3.x"
         cache: pip
diff --git a/.github/workflows/pre-commit-run.yml b/.github/workflows/pre-commit-run.yml
index 7a08b729..f9182696 100644
--- a/.github/workflows/pre-commit-run.yml
+++ b/.github/workflows/pre-commit-run.yml
@@ -45,7 +45,7 @@ jobs:
         persist-credentials: false
 
     - name: Set up Python
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: ${{ inputs.python-version }}
         allow-prereleases: true
diff --git a/.github/workflows/towncrier-run.yml b/.github/workflows/towncrier-run.yml
index 95710498..5ec0094b 100644
--- a/.github/workflows/towncrier-run.yml
+++ b/.github/workflows/towncrier-run.yml
@@ -58,7 +58,7 @@ jobs:
         persist-credentials: false
 
     - name: Setup Python
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: ${{ inputs.python-version }}
         allow-prereleases: true