diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml
index e82a1ad..455ac34 100644
--- a/.github/workflows/go-ci.yml
+++ b/.github/workflows/go-ci.yml
@@ -34,11 +34,11 @@ on:
       nox-version:
         description: "nox release version (no leading v)."
         type: string
-        default: "1.17.0"
+        default: "1.19.0"
       nox-sha256:
         description: "sha256 of nox_<version>_linux_amd64.tar.gz (verify on bump)."
         type: string
-        default: "1a7af79d12015e929925effdc428f034cc53f64be2a9099a6706c9e982a06e26"
+        default: "9d1029a686bd8df3477ef3034d65ab477631e7b2cdfee385e2b20295ffe834b8"
       nox-strict:
         description: "Fail on net-new critical/high even before a baseline exists. Default: gate only once a baseline is committed."
         type: boolean
diff --git a/.github/workflows/js-ci.yml b/.github/workflows/js-ci.yml
index 8c940c2..3d6ef40 100644
--- a/.github/workflows/js-ci.yml
+++ b/.github/workflows/js-ci.yml
@@ -36,10 +36,10 @@ on:
         default: "."
       nox-version:
         type: string
-        default: "1.17.0"
+        default: "1.19.0"
       nox-sha256:
         type: string
-        default: "1a7af79d12015e929925effdc428f034cc53f64be2a9099a6706c9e982a06e26"
+        default: "9d1029a686bd8df3477ef3034d65ab477631e7b2cdfee385e2b20295ffe834b8"
       nox-strict:
         description: "Fail on net-new critical/high even before a baseline exists."
         type: boolean
diff --git a/.github/workflows/nox-remediate.yml b/.github/workflows/nox-remediate.yml
index 02b422c..da4384a 100644
--- a/.github/workflows/nox-remediate.yml
+++ b/.github/workflows/nox-remediate.yml
@@ -25,11 +25,11 @@ on:
       nox-version:
         description: "nox release version (no leading v)."
         type: string
-        default: "1.17.0"
+        default: "1.19.0"
       nox-sha256:
         description: "sha256 of nox_<version>_linux_amd64.tar.gz (verify on bump)."
         type: string
-        default: "1a7af79d12015e929925effdc428f034cc53f64be2a9099a6706c9e982a06e26"
+        default: "9d1029a686bd8df3477ef3034d65ab477631e7b2cdfee385e2b20295ffe834b8"
       include-major:
         description: "Allow major-version action bumps (off by default; majors are surfaced but held)."
         type: boolean