diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index a57d5d7..5de77e2 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -26,9 +26,9 @@ jobs:
     name: Lint & format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: sidecar/go.mod
           check-latest: true
@@ -69,9 +69,9 @@ jobs:
     # runner's Docker daemon. GitHub sets CI=true, which makes it fail rather
     # than skip, so the persistence layer cannot drop out of this job.
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: sidecar/go.mod
           check-latest: true
@@ -87,9 +87,9 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: sidecar/go.mod
           check-latest: true
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index bfeb3a7..cca2cbf 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -24,17 +24,17 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build and push images
         run: |
@@ -47,10 +47,10 @@ jobs:
     needs: build-and-push
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install Doppler CLI
-        uses: dopplerhq/cli-action@v3
+        uses: dopplerhq/cli-action@v4
 
       - name: Install Ansible
         run: |
diff --git a/.github/workflows/govulncheck.yaml b/.github/workflows/govulncheck.yaml
index 08d2e05..d073679 100644
--- a/.github/workflows/govulncheck.yaml
+++ b/.github/workflows/govulncheck.yaml
@@ -24,12 +24,14 @@ jobs:
     name: govulncheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # The action still installs govulncheck itself at @latest.
       - name: Run govulncheck
         uses: golang/govulncheck-action@v1
         with:
+          # Override the action's default (`stable`) so setup-go uses go.mod.
+          go-version-input: ""
           go-version-file: sidecar/go.mod
           check-latest: true
           cache-dependency-path: sidecar/go.sum