diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index bb63b7c3..4d9e8fda 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -155,7 +155,7 @@ jobs:
                   submodules: true
 
             - name: "Set up Python"
-              uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+              uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
               with:
                   # PyO3 0.24 supports up to Python 3.13; add 3.14 when PyO3 upgrades
                   python-version: |
diff --git a/.github/workflows/sync-notebooks.yaml b/.github/workflows/sync-notebooks.yaml
index f9b8de37..471837f2 100644
--- a/.github/workflows/sync-notebooks.yaml
+++ b/.github/workflows/sync-notebooks.yaml
@@ -19,7 +19,7 @@ jobs:
         token: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Set up Python
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@v7.0.0
       with:
         python-version: '3.11'