diff --git a/.github/workflows/benchmark_backfill.yml b/.github/workflows/benchmark_backfill.yml
index 05f73afd42c..691ac6d3b30 100644
--- a/.github/workflows/benchmark_backfill.yml
+++ b/.github/workflows/benchmark_backfill.yml
@@ -70,7 +70,7 @@ jobs:
       - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
       - name: Check runner capacity
         run: |
           affinity=()
diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index ad5e5bb528e..f4a722b9b5e 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -36,7 +36,7 @@ jobs:
           ref: ${{ github.sha }}
           fetch-depth: 0
           persist-credentials: false
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
       - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index b40c8ed7b90..a8bb3984fbf 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 75
     steps:
       - uses: actions/checkout@v7
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
       - name: Restore Bazel compiled outputs
         id: bazel-cache
         uses: ./.github/actions/bazel-cache-restore
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 20b13050bba..3eec1af2795 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -30,7 +30,7 @@ jobs:
       - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
       - name: Check live repository tooling
         run: bazel run //tools:repository_tooling_test
       - uses: actions/setup-node@v7
@@ -87,7 +87,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       # bazelisk launches the Bazel release pinned in .bazelversion.
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
       # PRs restore main's latest compiled outputs. Every main run saves a new bounded
       # generation; GitHub cache entries cannot be updated in place.
       - name: Restore Bazel compiled outputs
@@ -218,7 +218,7 @@ jobs:
           sudo update-alternatives --set gcc /usr/bin/gcc-15
           gcc --version
           g++ --version
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
       - name: Restore Bazel compiled outputs
         id: bazel-cache
         uses: ./.github/actions/bazel-cache-restore
@@ -253,7 +253,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
       - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
@@ -285,7 +285,7 @@ jobs:
       FUZZ_SECONDS_PER_TARGET: 60
     steps:
       - uses: actions/checkout@v7
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
       - name: Restore Bazel compiled outputs
         id: bazel-cache
         uses: ./.github/actions/bazel-cache-restore
@@ -343,7 +343,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
       # Coverage instrumentation has distinct action keys, so keep its compiled outputs in a
       # dedicated cache rather than crowding out the ordinary Clang build. Prefix restoration lets a
       # later run reuse objects from the newest saved generation.
@@ -470,7 +470,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
       - name: Restore Bazel compiled outputs
         id: bazel-cache
         uses: ./.github/actions/bazel-cache-restore
@@ -517,7 +517,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
       - name: Restore Bazel compiled outputs
         id: bazel-cache
         uses: ./.github/actions/bazel-cache-restore
@@ -560,7 +560,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
       - name: Restore Bazel compiled outputs
         id: bazel-cache
         uses: ./.github/actions/bazel-cache-restore
@@ -602,7 +602,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
       - name: Restore Bazel compiled outputs
         id: bazel-cache
         uses: ./.github/actions/bazel-cache-restore
@@ -668,7 +668,7 @@ jobs:
             echo "CLANG_TIDY_SCOPE=none" >>"${GITHUB_ENV}"
             echo "No C++ source or header changed; clang-tidy is not required."
           fi
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
         if: env.CLANG_TIDY_ENABLED == 'true'
       - uses: actions/setup-python@v7
         if: env.CLANG_TIDY_ENABLED == 'true'
@@ -748,7 +748,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
       - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 58de810c81b..a06f18ef84d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -50,7 +50,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           ref: ${{ env.RELEASE_TAG }}
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
       # Tag caches cannot seed later releases or main; restore main outputs without saving.
       - name: Restore Bazel compiled outputs
         id: bazel-cache
@@ -160,7 +160,7 @@ jobs:
         with:
           ref: ${{ env.RELEASE_TAG }}
       # bazelisk launches the Bazel release pinned in .bazelversion.
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: bazel-contrib/setup-bazel@0.19.1
       # Tag caches cannot seed later releases or main; restore main outputs without saving.
       - name: Restore Bazel compiled outputs
         id: bazel-cache
diff --git a/tools/release_prep_test.sh b/tools/release_prep_test.sh
index 3232e8f858c..8bbe6d05252 100755
--- a/tools/release_prep_test.sh
+++ b/tools/release_prep_test.sh
@@ -300,8 +300,8 @@ test_workflows_use_setup_bazel() {
     fi
     workflow_setup_count=$(count_lines_with 'uses: bazel-contrib/setup-bazel@' "${workflow}")
     setup_count=$((setup_count + workflow_setup_count))
-    if [ "${workflow_setup_count}" -ne "$(count_lines_with 'uses: bazel-contrib/setup-bazel@0.19.0' "${workflow}")" ]; then
-      fail "workflow $(basename "${workflow}"): every setup-bazel use must pin 0.19.0"
+    if [ "${workflow_setup_count}" -ne "$(count_lines_with 'uses: bazel-contrib/setup-bazel@0.19.1' "${workflow}")" ]; then
+      fail "workflow $(basename "${workflow}"): every setup-bazel use must pin 0.19.1"
     fi
   done
   if [ "${setup_count}" -eq 0 ]; then