diff --git a/.github/workflows/pr-auditor.yml b/.github/workflows/pr-auditor.yml
index 626ebc4a070d..0a764265042f 100644
--- a/.github/workflows/pr-auditor.yml
+++ b/.github/workflows/pr-auditor.yml
@@ -10,7 +10,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
         with: { repository: 'sourcegraph/sourcegraph' }
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4
         with: { go-version: '1.18' }
 
       - run: ./dev/pr-auditor/check-pr.sh
diff --git a/.github/workflows/update-tags.yml b/.github/workflows/update-tags.yml
index 132ce8a8dbc8..14e2a94a5e00 100644
--- a/.github/workflows/update-tags.yml
+++ b/.github/workflows/update-tags.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e # tag=v2
-      - uses: actions/setup-go@331ce1d993939866bb63c32c6cbbfd48fa76fc57 # renovate: tag=v2
+      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4
         with:
           go-version: '^1.19'