diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 4dc576c..915ba22 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -36,7 +36,7 @@ jobs:
           persist-credentials: false
 
       - name: ⚙️ Set up .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           # Track global.json so the Copilot toolchain never drifts from the SDK
           # floor (the .NET parity to go-template's `go-version-file: go.mod`).
diff --git a/.github/workflows/validate-scaffold.yaml b/.github/workflows/validate-scaffold.yaml
index 4df84cb..5ea1508 100644
--- a/.github/workflows/validate-scaffold.yaml
+++ b/.github/workflows/validate-scaffold.yaml
@@ -35,7 +35,7 @@ jobs:
       - name: 🤖 Validate agent instruction shims
         run: sh scripts/validate-agent-shims.test.sh
       - name: 🧰 Set up .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           global-json-file: global.json # track the scaffold's SDK floor
       - name: 🧱 Validate onboarding (rename-placeholders.sh)