diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6c400d00..89706d5f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,7 +30,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
 
@@ -85,7 +85,7 @@ jobs:
           fetch-depth: 0  # full history for fixture repos with git commits
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
 
@@ -196,7 +196,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
 
@@ -265,7 +265,7 @@ jobs:
           fetch-depth: 0  # tags needed for the changelog discipline check
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
 
@@ -290,7 +290,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ff981e20..bd065add 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -21,7 +21,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
 
diff --git a/.github/workflows/release-rehearsal.yml b/.github/workflows/release-rehearsal.yml
index 225c15b4..b5c2055c 100644
--- a/.github/workflows/release-rehearsal.yml
+++ b/.github/workflows/release-rehearsal.yml
@@ -44,7 +44,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
 
@@ -101,7 +101,7 @@ jobs:
           node-version: '22.x'
           registry-url: 'https://registry.npmjs.org'
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e42ec04c..22f8e4be 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,7 +30,7 @@ jobs:
     - uses: actions/checkout@v6
       with:
         fetch-depth: 0
-    - uses: actions/setup-go@v6
+    - uses: actions/setup-go@v7
       with:
         go-version-file: go.mod
     - uses: actions/setup-node@v6
@@ -86,7 +86,7 @@ jobs:
       with:
         fetch-depth: 0
 
-    - uses: actions/setup-go@v6
+    - uses: actions/setup-go@v7
       with:
         go-version-file: go.mod
 
@@ -420,7 +420,7 @@ jobs:
     # publish fails with `go: not found`. Found in the final
     # polish review — the previous shape would have crashed on first
     # release attempt.
-    - uses: actions/setup-go@v6
+    - uses: actions/setup-go@v7
       with:
         go-version-file: go.mod
         cache: true
diff --git a/.github/workflows/terrain-ai.yml b/.github/workflows/terrain-ai.yml
index c7139666..747735be 100644
--- a/.github/workflows/terrain-ai.yml
+++ b/.github/workflows/terrain-ai.yml
@@ -24,7 +24,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
 
diff --git a/.github/workflows/terrain-pr.yml b/.github/workflows/terrain-pr.yml
index 1eb4f414..20472351 100644
--- a/.github/workflows/terrain-pr.yml
+++ b/.github/workflows/terrain-pr.yml
@@ -25,7 +25,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod