diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c60820f7..2f913a24 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python }}
           cache: pip
@@ -62,7 +62,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip
@@ -127,7 +127,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/diff-coverage-comment.yml b/.github/workflows/diff-coverage-comment.yml
index 5c9c95b2..97bb8099 100644
--- a/.github/workflows/diff-coverage-comment.yml
+++ b/.github/workflows/diff-coverage-comment.yml
@@ -85,7 +85,7 @@ jobs:
           persist-credentials: false
           path: base
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         if: steps.report.outputs.found == 'true'
         with:
           python-version: "3.12"
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 150b6f22..b036e000 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -18,7 +18,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip
diff --git a/.github/workflows/install-sh.yml b/.github/workflows/install-sh.yml
index 066ea25e..17fc69e9 100644
--- a/.github/workflows/install-sh.yml
+++ b/.github/workflows/install-sh.yml
@@ -62,7 +62,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/koth-engine-gate.yml b/.github/workflows/koth-engine-gate.yml
index 394c075e..e11bf030 100644
--- a/.github/workflows/koth-engine-gate.yml
+++ b/.github/workflows/koth-engine-gate.yml
@@ -111,7 +111,7 @@ jobs:
 
       - name: set up python
         if: steps.classify.outputs.mode == 'engine'
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
 
diff --git a/.github/workflows/koth-gate.yml b/.github/workflows/koth-gate.yml
index 548d4605..5b39b7d4 100644
--- a/.github/workflows/koth-gate.yml
+++ b/.github/workflows/koth-gate.yml
@@ -93,7 +93,7 @@ jobs:
 
       - name: set up python
         if: steps.classify.outputs.mode == 'ladder'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: '3.12'
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ecf72afa..81e499bb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,7 @@ jobs:
         with:
           node-version: "20"
       - run: npm --prefix webapp ci && npm --prefix webapp run build
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - run: python -m pip install --upgrade build
diff --git a/.github/workflows/schema-check.yml b/.github/workflows/schema-check.yml
index 4d6f1756..3dfb64a0 100644
--- a/.github/workflows/schema-check.yml
+++ b/.github/workflows/schema-check.yml
@@ -17,7 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index 840e8598..71251ebe 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -26,7 +26,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip
diff --git a/.github/workflows/ui-screenshot-gate.yml b/.github/workflows/ui-screenshot-gate.yml
index 4a9bc43a..d4af847c 100644
--- a/.github/workflows/ui-screenshot-gate.yml
+++ b/.github/workflows/ui-screenshot-gate.yml
@@ -16,7 +16,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - name: fetch changed files + body (as files, not interpolated)
diff --git a/.github/workflows/vouchbench-season.yml b/.github/workflows/vouchbench-season.yml
index ede4d9ba..f3db2282 100644
--- a/.github/workflows/vouchbench-season.yml
+++ b/.github/workflows/vouchbench-season.yml
@@ -40,7 +40,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - name: Install vouch