diff --git a/.github/workflows/pr-auditor.yml b/.github/workflows/pr-auditor.yml
index cdd92bfc55b4..5028e014d2e2 100644
--- a/.github/workflows/pr-auditor.yml
+++ b/.github/workflows/pr-auditor.yml
@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           repository: 'sourcegraph/pr-auditor'
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5
         with: { go-version: '1.21' }
 
       - run: './check-pr.sh'
diff --git a/.github/workflows/update-tags.yml b/.github/workflows/update-tags.yml
index 787aa511a8db..05c6dfac54ae 100644
--- a/.github/workflows/update-tags.yml
+++ b/.github/workflows/update-tags.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e # tag=v2
-      - uses: actions/setup-go@331ce1d993939866bb63c32c6cbbfd48fa76fc57 # renovate: tag=v2
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5
         with:
           go-version: '^1.21'