diff --git a/.github/workflows/ci-gpu.yml b/.github/workflows/ci-gpu.yml
index 1b56a2d..d47d9d8 100644
--- a/.github/workflows/ci-gpu.yml
+++ b/.github/workflows/ci-gpu.yml
@@ -40,7 +40,7 @@ jobs:
           fetch-depth: 0
       - name: Check NVIDIA SMI
         run: nvidia-smi
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.3.0
         with:
           python-version: "3.12"
       - uses: astral-sh/setup-uv@v8.3.2
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 494ef7d..bebdc60 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -79,7 +79,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         with: { fetch-depth: 0, filter: "blob:none" }
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.3.0
         with:
           python-version: '3.14'
       - uses: astral-sh/setup-uv@v8.3.2
@@ -94,7 +94,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         with: { fetch-depth: 0, filter: "blob:none" }
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.3.0
         with:
           python-version: '3.14'
       - uses: astral-sh/setup-uv@v8.3.2
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f1759ef..a836ee1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,7 +14,7 @@ jobs:
       id-token: write # to authenticate as Trusted Publisher to pypi.org
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.3.0
         with:
           python-version: "3.x"
           cache: pip