diff --git a/.github/workflows/clean-install.yml b/.github/workflows/clean-install.yml
index 471ebc7f3..decc8dcf2 100644
--- a/.github/workflows/clean-install.yml
+++ b/.github/workflows/clean-install.yml
@@ -24,7 +24,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.11"
       - name: Install uv from public PyPI
diff --git a/.github/workflows/harness.yml b/.github/workflows/harness.yml
index b4bc1000a..45710986b 100644
--- a/.github/workflows/harness.yml
+++ b/.github/workflows/harness.yml
@@ -39,7 +39,7 @@ jobs:
         openenv: ["locked", "latest"]
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install from uv.lock, with the latest OpenEnv for latest
diff --git a/.github/workflows/local-backends.yml b/.github/workflows/local-backends.yml
index 5db6b9769..d18c44c9e 100644
--- a/.github/workflows/local-backends.yml
+++ b/.github/workflows/local-backends.yml
@@ -30,7 +30,7 @@ jobs:
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install from uv.lock
@@ -93,7 +93,7 @@ jobs:
           - 5000:5000
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install from uv.lock
@@ -129,7 +129,7 @@ jobs:
     timeout-minutes: 40
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install from uv.lock
@@ -177,7 +177,7 @@ jobs:
     timeout-minutes: 40
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install from uv.lock
@@ -264,7 +264,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install from uv.lock
diff --git a/.github/workflows/miles.yml b/.github/workflows/miles.yml
index c89cd6280..0a60c7efa 100644
--- a/.github/workflows/miles.yml
+++ b/.github/workflows/miles.yml
@@ -43,7 +43,7 @@ jobs:
         miles: ["v0.1.3", "main"]
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install from uv.lock with the miles extra
diff --git a/.github/workflows/nemo-gym.yml b/.github/workflows/nemo-gym.yml
index 8f59b8a14..021cfb1d1 100644
--- a/.github/workflows/nemo-gym.yml
+++ b/.github/workflows/nemo-gym.yml
@@ -40,7 +40,7 @@ jobs:
         nemo-gym: ["locked", "latest"]
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.13"
       - name: Install from uv.lock with the nemo-gym extra
diff --git a/.github/workflows/plugin-api.yml b/.github/workflows/plugin-api.yml
index 0bbe0c9d5..fae3d83e2 100644
--- a/.github/workflows/plugin-api.yml
+++ b/.github/workflows/plugin-api.yml
@@ -32,7 +32,7 @@ jobs:
         with:
           fetch-depth: 2
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       # The title is read when the job runs, so a re-run sees an edited one. Only this step has the
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index a3b59d054..8fdab738a 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -77,7 +77,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install uv from public PyPI
@@ -188,7 +188,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install uv from public PyPI
@@ -384,7 +384,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install uv from public PyPI
@@ -447,7 +447,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install uv from public PyPI
diff --git a/.github/workflows/skyrl.yml b/.github/workflows/skyrl.yml
index 7500c80fe..aa5a37500 100644
--- a/.github/workflows/skyrl.yml
+++ b/.github/workflows/skyrl.yml
@@ -47,7 +47,7 @@ jobs:
               skyrl-gym@git+https://github.com/NovaSky-AI/SkyRL@main#subdirectory=skyrl-gym
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install from uv.lock with the skyrl extra
diff --git a/.github/workflows/slime.yml b/.github/workflows/slime.yml
index b3a1a3f46..d94ac4380 100644
--- a/.github/workflows/slime.yml
+++ b/.github/workflows/slime.yml
@@ -43,7 +43,7 @@ jobs:
         slime: ["540ea919e45b8b929198abce008a103be9cfc779", "main"]
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install from uv.lock with the slime extra
diff --git a/.github/workflows/trl.yml b/.github/workflows/trl.yml
index cc6149665..8806badbb 100644
--- a/.github/workflows/trl.yml
+++ b/.github/workflows/trl.yml
@@ -45,7 +45,7 @@ jobs:
             transformers: "transformers==5.17.*"
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install from uv.lock, then TRL and CPU torch
diff --git a/.github/workflows/verifiers.yml b/.github/workflows/verifiers.yml
index 6a2c00aa6..d2f80ec13 100644
--- a/.github/workflows/verifiers.yml
+++ b/.github/workflows/verifiers.yml
@@ -46,7 +46,7 @@ jobs:
             requirement: "verifiers @ git+https://github.com/PrimeIntellect-ai/verifiers@main"
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.13"
       - name: Install from uv.lock with the nemo-gym extra
diff --git a/.github/workflows/verl.yml b/.github/workflows/verl.yml
index ad20854e8..8216caf4d 100644
--- a/.github/workflows/verl.yml
+++ b/.github/workflows/verl.yml
@@ -44,7 +44,7 @@ jobs:
             requirement: "verl @ git+https://github.com/volcengine/verl@main"
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install from uv.lock with the verl extra