diff --git a/.github/workflows/audit-jayyhk-matrix.yml b/.github/workflows/audit-jayyhk-matrix.yml
index ed8017bf..d7250024 100644
--- a/.github/workflows/audit-jayyhk-matrix.yml
+++ b/.github/workflows/audit-jayyhk-matrix.yml
@@ -116,7 +116,7 @@ jobs:
           base.write_text(json.dumps(merged, indent=2))
           print(f"merged {len(merged)} jayyhk verdicts")
           EOF
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
       # Same uv pin as audit-proofs.yml, for the same reason: this job commits
diff --git a/.github/workflows/audit-proofs.yml b/.github/workflows/audit-proofs.yml
index 25dba182..5286c0d8 100644
--- a/.github/workflows/audit-proofs.yml
+++ b/.github/workflows/audit-proofs.yml
@@ -85,7 +85,7 @@ jobs:
         run: JAYYHK="$GITHUB_WORKSPACE/proof-repos/jayyhk" bash lean/build-jayyhk.sh v4.29.1 v4.27.0
 
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
       # uv's version is pinned, not just the action's. uv.lock carries a format