diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a5e814d4..a1ef17e3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,7 +37,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.12'
       - uses: dtolnay/rust-toolchain@1.98.0
@@ -67,7 +67,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, macos-15-intel, windows-latest]
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.12'
       - run: python -m pip install -r scripts/readiness/requirements.txt
diff --git a/.github/workflows/codebuild.yml b/.github/workflows/codebuild.yml
index d151bccc..ebc53932 100644
--- a/.github/workflows/codebuild.yml
+++ b/.github/workflows/codebuild.yml
@@ -46,7 +46,7 @@ jobs:
           # pull_request must validate the PR tree (github.sha). pin the base
           # only for pull_request_target, which must not execute unapproved code.
           ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }}
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.12'
       - run: python -m pip install -r scripts/readiness/requirements.txt