diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml
index 889b56b..4da9c1a 100644
--- a/.github/workflows/cd.yaml
+++ b/.github/workflows/cd.yaml
@@ -22,7 +22,7 @@ jobs:
           persist-credentials: false
 
       - name: ⚙️ Setup Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           # Track the go.mod floor so the release toolchain never drifts below it
           # (setup-go pins GOTOOLCHAIN=local for an explicit go-version, which then
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 2b07183..3d634f8 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -34,7 +34,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           # Track go.mod so the Copilot toolchain never drifts from the module floor.
           go-version-file: go.mod
diff --git a/.github/workflows/validate-scaffold.yaml b/.github/workflows/validate-scaffold.yaml
index c221930..b135bb7 100644
--- a/.github/workflows/validate-scaffold.yaml
+++ b/.github/workflows/validate-scaffold.yaml
@@ -38,7 +38,7 @@ jobs:
       - name: 🤖 Validate agent instruction shims
         run: sh scripts/validate-agent-shims.test.sh
       - name: 🐹 Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
       - name: 🧱 Validate onboarding (rename-placeholders.sh)