diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2c796121..4171677e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -173,7 +173,7 @@ jobs:
 
       - name: Install Python
         if: needs.validation-plan.outputs.mode == 'full'
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.14.7"
 
@@ -331,7 +331,7 @@ jobs:
 
       - name: Install Python for source verification
         if: needs.validation-plan.outputs.mode == 'full'
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.14.7"
 
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index ac37119d..02482f41 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -25,7 +25,7 @@ jobs:
           cache: true
           cache-dependency-path: '**/packages.lock.json'
       - name: Install Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.14.7'
       - name: Restore and build