diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index 487e66b..4affb1a 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -60,7 +60,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.11'
 
diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml
index 0e762b2..b7040ef 100644
--- a/.github/workflows/pre-commit.yaml
+++ b/.github/workflows/pre-commit.yaml
@@ -17,7 +17,7 @@ jobs:
       uses: actions/checkout@v7
 
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: '3.12'
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2632a0c..fadd75c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -38,7 +38,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.11'
 
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index cd118a5..18dd38b 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -32,13 +32,25 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.11'
 
       - name: Install project + audit tooling
         run: |
-          python -m pip install --upgrade pip
+          # setuptools is upgraded explicitly, not just pip. The runner
+          # image ships whatever setuptools its Python bundled, that
+          # version lands in the freeze list below, and the audit then
+          # reports a CVE in a build tool jvspatial neither declares as a
+          # runtime dependency nor vendors into its wheel (PYSEC-2026-3447
+          # in setuptools 79.0.1, fixed in 83.0.0).
+          #
+          # Deliberately NOT floored in pyproject's [build-system]
+          # requires: setuptools 83 needs Python >=3.10 while jvspatial
+          # supports >=3.9, so pinning it there makes a source build
+          # unresolvable on 3.9. This job pins 3.11, so upgrading here is
+          # safe and keeps the audit signal about *our* dependencies.
+          python -m pip install --upgrade pip setuptools
           pip install pip-audit
           # Resolve the project's full dependency set so the audit
           # sees the same packages adopters would install.
diff --git a/.github/workflows/test-jvspatial.yaml b/.github/workflows/test-jvspatial.yaml
index b99ea94..6a0334a 100644
--- a/.github/workflows/test-jvspatial.yaml
+++ b/.github/workflows/test-jvspatial.yaml
@@ -18,7 +18,7 @@ jobs:
       uses: actions/checkout@v7
 
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ matrix.python-version }}