diff --git a/.github/actions/lint/action.yml b/.github/actions/lint/action.yml
index d721f204e..dc18ab2aa 100644
--- a/.github/actions/lint/action.yml
+++ b/.github/actions/lint/action.yml
@@ -5,7 +5,7 @@ runs:
   using: composite
   steps:
     - name: Install Go
-      uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
       with:
         go-version: 1.25.x
         check-latest: true
diff --git a/.github/actions/test-common/action.yml b/.github/actions/test-common/action.yml
index 42a79f0d1..42d24251d 100644
--- a/.github/actions/test-common/action.yml
+++ b/.github/actions/test-common/action.yml
@@ -15,7 +15,7 @@ runs:
   steps:
     - name: Install Go
       if: ${{ inputs.go_version != 'gotip' }}
-      uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
       with:
         go-version: ${{ inputs.go_version }}
         check-latest: true
diff --git a/.github/workflows/browser_e2e.yml b/.github/workflows/browser_e2e.yml
index 7779c1e58..f51e20e30 100644
--- a/.github/workflows/browser_e2e.yml
+++ b/.github/workflows/browser_e2e.yml
@@ -31,7 +31,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         with:
           go-version: 1.x
       - name: Install Go tip
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5809451a5..52265e81b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -108,7 +108,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Install Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         with:
           go-version: ${{ needs.configure.outputs.go_version }}
           check-latest: true
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index b8a5f7937..5c97e58ce 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -21,7 +21,7 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
       - name: Install Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         with:
           go-version: 1.25.x
           check-latest: true
diff --git a/.github/workflows/tc39.yml b/.github/workflows/tc39.yml
index 74a92aab6..8ff35de5e 100644
--- a/.github/workflows/tc39.yml
+++ b/.github/workflows/tc39.yml
@@ -26,7 +26,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         with:
           go-version: 1.25.x
           check-latest: true
diff --git a/.github/workflows/wpt.yml b/.github/workflows/wpt.yml
index 274a93c7e..617a19e8f 100644
--- a/.github/workflows/wpt.yml
+++ b/.github/workflows/wpt.yml
@@ -19,7 +19,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         with:
           go-version: 1.25.x
           check-latest: true
diff --git a/.github/workflows/xk6.yml b/.github/workflows/xk6.yml
index d4e815da5..13a57a021 100644
--- a/.github/workflows/xk6.yml
+++ b/.github/workflows/xk6.yml
@@ -29,7 +29,7 @@ jobs:
           persist-credentials: false
       - name: Install Go
         if: matrix.go != 'tip'
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         with:
           go-version: 1.25.x
           check-latest: true