diff --git a/.github/workflows/quality-lint.yaml b/.github/workflows/quality-lint.yaml
index c5bf894..d6e20f5 100644
--- a/.github/workflows/quality-lint.yaml
+++ b/.github/workflows/quality-lint.yaml
@@ -13,7 +13,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: false # Zero external dependencies (stdlib only)
diff --git a/.github/workflows/quality-test.yaml b/.github/workflows/quality-test.yaml
index e81b1ff..26f81d3 100644
--- a/.github/workflows/quality-test.yaml
+++ b/.github/workflows/quality-test.yaml
@@ -13,7 +13,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: false # Zero external dependencies (stdlib only)
diff --git a/.github/workflows/release-build.yaml b/.github/workflows/release-build.yaml
index caf3675..6207754 100644
--- a/.github/workflows/release-build.yaml
+++ b/.github/workflows/release-build.yaml
@@ -21,7 +21,7 @@ jobs:
           fetch-depth: 0
           ref: ${{ inputs.ref || '' }}
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: false
diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml
index d95a526..0ccaa60 100644
--- a/.github/workflows/security-scan.yaml
+++ b/.github/workflows/security-scan.yaml
@@ -13,7 +13,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: false
diff --git a/.github/workflows/security-secrets.yaml b/.github/workflows/security-secrets.yaml
index f13274d..9cc0c26 100644
--- a/.github/workflows/security-secrets.yaml
+++ b/.github/workflows/security-secrets.yaml
@@ -32,6 +32,6 @@ jobs:
 
       - name: Upload SARIF report
         if: always() && hashFiles('results.sarif') != ''
-        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           sarif_file: results.sarif