diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0582e7a..23de4d5 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,10 +19,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
-      - uses: github/codeql-action/init@v4
+      - uses: github/codeql-action/init@v4.37.4
         with:
           languages: go
-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/analyze@v4.37.4
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 45570a5..ecf81f5 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod # single source of truth for the Go version
           check-latest: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 44edb33..a9913a7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # full history so the changelog generator sees prior tags
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           check-latest: true
diff --git a/.github/workflows/still-active.yml b/.github/workflows/still-active.yml
index 45aa082..26cd4d8 100644
--- a/.github/workflows/still-active.yml
+++ b/.github/workflows/still-active.yml
@@ -29,7 +29,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
 
@@ -59,7 +59,7 @@ jobs:
           github-token: ${{ github.token }}
           sarif: still_active.sarif.json
 
-      - uses: github/codeql-action/upload-sarif@v4
+      - uses: github/codeql-action/upload-sarif@v4.37.4
         if: always()
         with:
           sarif_file: still_active.sarif.json