diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index c58cec6..b634b95 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -36,7 +36,7 @@ jobs:
           persist-credentials: false
 
       - name: ⚙️ Set up .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           # Track global.json so the Copilot toolchain never drifts from the SDK
           # floor (the .NET parity to go-template's `go-version-file: go.mod`).
diff --git a/.github/workflows/validate-scaffold.yaml b/.github/workflows/validate-scaffold.yaml
index d482620..ddef2ea 100644
--- a/.github/workflows/validate-scaffold.yaml
+++ b/.github/workflows/validate-scaffold.yaml
@@ -31,7 +31,7 @@ jobs:
         with:
           persist-credentials: false # read-only job; never pushes
       - name: 🧰 Set up .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           global-json-file: global.json # track the scaffold's SDK floor
       - name: 🧱 Validate onboarding (rename-placeholders.sh)