diff --git a/.github/workflows/check_toml.yml b/.github/workflows/check_toml.yml
index b7a277f873..279e57f95d 100644
--- a/.github/workflows/check_toml.yml
+++ b/.github/workflows/check_toml.yml
@@ -196,7 +196,7 @@ jobs:
             core.exportVariable("REFERENCE_FILE", referenceFilePath);
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/coverage-aggregate.yml b/.github/workflows/coverage-aggregate.yml
index bbed57db4d..42aa971971 100644
--- a/.github/workflows/coverage-aggregate.yml
+++ b/.github/workflows/coverage-aggregate.yml
@@ -62,7 +62,7 @@ jobs:
           cache-disabled: true
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/docker-compose-tests.yml b/.github/workflows/docker-compose-tests.yml
index 2db9e5cf72..68bc1722be 100644
--- a/.github/workflows/docker-compose-tests.yml
+++ b/.github/workflows/docker-compose-tests.yml
@@ -74,7 +74,7 @@ jobs:
           sudo chmod +x /usr/local/bin/docker-compose
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
           cache: "pip" # caching pip dependencies
diff --git a/.github/workflows/e2e-live.yml b/.github/workflows/e2e-live.yml
index 3a1b4e3af1..a082f89bf5 100644
--- a/.github/workflows/e2e-live.yml
+++ b/.github/workflows/e2e-live.yml
@@ -84,7 +84,7 @@ jobs:
           fi
       - name: Set up Python for coverage summary
         if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - name: Install defusedxml for coverage summary
@@ -124,7 +124,7 @@ jobs:
         # a summary even on backend failure, as long as some Playwright
         # tests ran far enough to dump V8 coverage.
         if: always()
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/frontend-validation.yml b/.github/workflows/frontend-validation.yml
index a539a1b7b7..0e0a35a25e 100644
--- a/.github/workflows/frontend-validation.yml
+++ b/.github/workflows/frontend-validation.yml
@@ -117,7 +117,7 @@ jobs:
         run: task frontend:test:coverage
       - name: Set up Python for coverage summary
         if: always()
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - name: Install defusedxml for coverage summary
diff --git a/.github/workflows/sync_files_v2.yml b/.github/workflows/sync_files_v2.yml
index 357f5d5a87..656c636e48 100644
--- a/.github/workflows/sync_files_v2.yml
+++ b/.github/workflows/sync_files_v2.yml
@@ -52,7 +52,7 @@ jobs:
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
           cache: "pip" # caching pip dependencies