diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 845b355c0..e8994983a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,7 +30,7 @@ jobs:
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
-      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa
+      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
         with:
           python-version: ${{ matrix.conf.py }}
           cache: "pip"
@@ -84,7 +84,7 @@ jobs:
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v3.2.0
 
-      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa
+      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
         with:
           python-version: '3.x'
 
diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml
index 9626e6d44..af938f4b1 100644
--- a/.github/workflows/conformance.yml
+++ b/.github/workflows/conformance.yml
@@ -13,7 +13,7 @@ jobs:
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
-      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa
+      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
         with:
           python-version: "3.x"
           cache: "pip"
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 7df119b89..cc4fda271 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -11,7 +11,7 @@ jobs:
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
-      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa # v4.8.0
+      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
         with:
           # NOTE: We use 3.10+ typing syntax via future, which pdoc only
           # understands if it's actually run with Python 3.10 or newer.
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 006c27961..379640799 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -13,7 +13,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       # NOTE: We intentionally lint against our minimum supported Python.
-      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa
+      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
         with:
           python-version: "3.8"
           cache: "pip"
@@ -32,7 +32,7 @@ jobs:
 
       # NOTE: We intentionally check `--help` rendering against our minimum Python,
       # since it changes slightly between Python versions.
-      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa
+      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
         with:
           python-version: "3.8"
           cache: "pip"
@@ -63,7 +63,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       # NOTE: We intentionally check test certificates against our minimum supported Python.
-      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa
+      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
         with:
           python-version: "3.8"
           cache: "pip"
diff --git a/.github/workflows/pin-requirements.yml b/.github/workflows/pin-requirements.yml
index abb13392c..b180f56b7 100644
--- a/.github/workflows/pin-requirements.yml
+++ b/.github/workflows/pin-requirements.yml
@@ -68,7 +68,7 @@ jobs:
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git config user.name "github-actions[bot]"
 
-      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa
+      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
         with:
           python-version-file: install/.python-version
           cache: "pip"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bf262929b..935f06ce8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
-      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa
+      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
         with:
           python-version: "3.x"
           cache: "pip"
diff --git a/.github/workflows/requirements.yml b/.github/workflows/requirements.yml
index a8698f310..228cb358e 100644
--- a/.github/workflows/requirements.yml
+++ b/.github/workflows/requirements.yml
@@ -35,7 +35,7 @@ jobs:
         with:
           ref: ${{ env.SIGSTORE_REF }}
 
-      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa
+      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
         name: Install Python ${{ matrix.python_version }}
         with:
           python-version: ${{ matrix.python_version }}
diff --git a/.github/workflows/staging-tests.yml b/.github/workflows/staging-tests.yml
index 377776b92..a7ca4e5c8 100644
--- a/.github/workflows/staging-tests.yml
+++ b/.github/workflows/staging-tests.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
-      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa
+      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
         with:
           python-version: "3.x"
           cache: "pip"