diff --git a/.github/workflows/python-release.yml b/.github/workflows/python-release.yml
index cef410c0..4e23ba9b 100644
--- a/.github/workflows/python-release.yml
+++ b/.github/workflows/python-release.yml
@@ -27,10 +27,10 @@ jobs:
     permissions:
       id-token: write # PyPI trusted publishing (OIDC) — no token/secret needed
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: 'main'
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
       - name: 🧪 Unit tests (release guard)
diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index e9b34981..a07afd86 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -36,8 +36,8 @@ jobs:
         # 4.44 requires it, and network capture requires 4.44+.
         python-version: ['3.10', '3.13']
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
       # selenium is the adapter's only runtime dependency, and the tests that