diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 9603bae..2f340f9 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -52,7 +52,7 @@ jobs:
 
             # setup-go reads go.work's `toolchain` line ahead of its `go` line, so the scan
             # runs on the toolchain the services ship, not whatever 1.24.x the runner cached.
-            - uses: actions/setup-go@v6
+            - uses: actions/setup-go@v7
               with:
                   go-version-file: go.work
                   # No go.sum exists to hash — the Go half takes no third-party dependency.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 21cb4a0..27c7f7f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -72,7 +72,7 @@ jobs:
             # Keyed on the go.mod files rather than go.sum: the Go half takes no
             # third-party dependency, so no go.sum exists to hash. A guard on go.work being present
             # would turn a lost workspace file into a skipped gate rather than a failing one.
-            - uses: actions/setup-go@v6
+            - uses: actions/setup-go@v7
               with:
                   go-version-file: go.work
                   cache-dependency-path: |
@@ -161,7 +161,7 @@ jobs:
         steps:
             - uses: actions/checkout@v6
 
-            - uses: actions/setup-go@v6
+            - uses: actions/setup-go@v7
               with:
                   go-version-file: go.work
                   cache-dependency-path: |