diff --git a/.github/workflows/build-publish.yml b/.github/workflows/build-publish.yml
index 335e83d..de311f5 100644
--- a/.github/workflows/build-publish.yml
+++ b/.github/workflows/build-publish.yml
@@ -19,7 +19,7 @@ jobs:
     - name: Checkout this repo
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Set up Python
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
           python-version: '3.14'
     - name: Install Poetry
@@ -61,7 +61,7 @@ jobs:
         name: python-package-distributions
         path: dist/
     - name: Publish distribution to TestPyPI
-      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+      uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
       with:
         skip-existing: true
         attestations: true
@@ -85,7 +85,7 @@ jobs:
         name: python-package-distributions
         path: dist/
     - name: Publish distribution to PyPI
-      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+      uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
       with:
         skip-existing: true
         attestations: true
diff --git a/.github/workflows/bump-pyproject.yml b/.github/workflows/bump-pyproject.yml
index 7a6e054..ac595c4 100644
--- a/.github/workflows/bump-pyproject.yml
+++ b/.github/workflows/bump-pyproject.yml
@@ -21,7 +21,7 @@ jobs:
         token: ${{ secrets.MY_GITHUB_TOKEN }}
 
     - name: Set up Python
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
           python-version: '3.13'
 
diff --git a/.github/workflows/interop.yml b/.github/workflows/interop.yml
index 9f4a1a3..bae3f16 100644
--- a/.github/workflows/interop.yml
+++ b/.github/workflows/interop.yml
@@ -35,7 +35,7 @@ jobs:
       - name: Resolve the EE FQDN to localhost (matches the cert CN)
         run: echo "127.0.0.1 vip.ve.atsign.zone" | sudo tee -a /etc/hosts
 
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.14'
       - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2
diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml
index 878fd0f..89a948e 100644
--- a/.github/workflows/python-package.yml
+++ b/.github/workflows/python-package.yml
@@ -28,7 +28,7 @@ jobs:
     - name: Checkout at_python
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install uv