diff --git a/.github/workflows/auth-contract-compose-pw.yml b/.github/workflows/auth-contract-compose-pw.yml
index 6231df3..297e5c6 100644
--- a/.github/workflows/auth-contract-compose-pw.yml
+++ b/.github/workflows/auth-contract-compose-pw.yml
@@ -69,7 +69,7 @@ jobs:
           path: common
 
       - name: Set up Node (for Playwright)
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
           cache: 'npm'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5ebc93c..439dc40 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -122,7 +122,7 @@ jobs:
       - name: Place ../common for Go replace directive
         run: mv _common_ci ../common
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.25'
 
@@ -227,7 +227,7 @@ jobs:
           path: _common_ci
       - run: mv _common_ci ../common
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.25'
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0b5d570..06cdf2f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -33,7 +33,7 @@ jobs:
         with:
           repository: InstaNode-dev/proto
           path: proto
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: api/go.mod
       - uses: github/codeql-action/init@v4
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 3304d4c..f0d3f21 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -114,7 +114,7 @@ jobs:
           token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: common
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: api/go.mod
 
@@ -159,7 +159,7 @@ jobs:
       # coverage" step above is continue-on-error, so it still produces
       # coverage.out even if a flaky test trips — the gate reads that file.
       # ------------------------------------------------------------------
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         if: github.event_name == 'pull_request'
         with:
           python-version: '3.12'
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index ead334a..013bd24 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -132,7 +132,7 @@ jobs:
           echo "Built ${VERSION} (${BUILD_TIME})"
 
       - name: Set up Go (for unit tests + go.mod replace directives)
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: '1.25'
           # This workflow checks the api repo out into ./api (path: api above),
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index f511ec1..a4e6e03 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -34,7 +34,7 @@ jobs:
           repository: InstaNode-dev/proto
           path: proto
         continue-on-error: true
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: api/go.mod
       - uses: golangci/golangci-lint-action@v9
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 1a6ea74..c7696e7 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -30,7 +30,7 @@ jobs:
         with:
           repository: InstaNode-dev/proto
           path: proto
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: api/go.mod
           check-latest: true
diff --git a/.github/workflows/integration-backup.yml b/.github/workflows/integration-backup.yml
index e64cdc7..7ab529a 100644
--- a/.github/workflows/integration-backup.yml
+++ b/.github/workflows/integration-backup.yml
@@ -62,7 +62,7 @@ jobs:
       - name: Install kubectl
         uses: azure/setup-kubectl@v5
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: api/go.mod
       - name: Materialise drill kubeconfig
diff --git a/.github/workflows/openapi-snapshot.yml b/.github/workflows/openapi-snapshot.yml
index 2668f53..17dfb55 100644
--- a/.github/workflows/openapi-snapshot.yml
+++ b/.github/workflows/openapi-snapshot.yml
@@ -69,7 +69,7 @@ jobs:
       - name: Place ../common for Go replace directive
         run: mv _common_ci ../common
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.25'