diff --git a/.github/actions/setup-python-tox/action.yml b/.github/actions/setup-python-tox/action.yml
index aad6dbc8a..3df6de818 100644
--- a/.github/actions/setup-python-tox/action.yml
+++ b/.github/actions/setup-python-tox/action.yml
@@ -10,7 +10,7 @@ runs:
   using: composite
   steps:
     - name: Set up Python
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      uses: actions/setup-python@v7.0.0
       with:
         python-version: ${{ inputs.python-version }}
         cache: pip
diff --git a/.github/workflows/check_sphinx_links.yml b/.github/workflows/check_sphinx_links.yml
index 5f3719303..7f763a1ac 100644
--- a/.github/workflows/check_sphinx_links.yml
+++ b/.github/workflows/check_sphinx_links.yml
@@ -23,7 +23,7 @@ jobs:
           fetch-depth: 0  # tags are required to determine the version
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/deploy_release.yml b/.github/workflows/deploy_release.yml
index f62ae7083..01ed9433d 100644
--- a/.github/workflows/deploy_release.yml
+++ b/.github/workflows/deploy_release.yml
@@ -23,7 +23,7 @@ jobs:
           fetch-depth: 0  # tags are required for versioneer to determine the version
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/run_coverage.yml b/.github/workflows/run_coverage.yml
index ac38ca2f1..eb8df07be 100644
--- a/.github/workflows/run_coverage.yml
+++ b/.github/workflows/run_coverage.yml
@@ -44,7 +44,7 @@ jobs:
           fetch-depth: 0  # tags are required to determine the version
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: ${{ env.PYTHON }}
 
diff --git a/.github/workflows/run_hdmf_zarr_tests.yml b/.github/workflows/run_hdmf_zarr_tests.yml
index 0f84613b0..0a0e6a665 100644
--- a/.github/workflows/run_hdmf_zarr_tests.yml
+++ b/.github/workflows/run_hdmf_zarr_tests.yml
@@ -23,7 +23,7 @@ jobs:
           fetch-depth: 0  # tags are required to determine the version
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/run_nwb_extension_tests.yml b/.github/workflows/run_nwb_extension_tests.yml
index fb6a10121..6c208b13c 100644
--- a/.github/workflows/run_nwb_extension_tests.yml
+++ b/.github/workflows/run_nwb_extension_tests.yml
@@ -63,7 +63,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.11'
 
@@ -103,7 +103,7 @@ jobs:
           fetch-depth: 0  # tags are required to determine the version
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.11'  # Use 3.11 for better compatibility with extensions
 
diff --git a/.github/workflows/run_pynwb_tests.yml b/.github/workflows/run_pynwb_tests.yml
index c63250e57..cefa2d37e 100644
--- a/.github/workflows/run_pynwb_tests.yml
+++ b/.github/workflows/run_pynwb_tests.yml
@@ -23,7 +23,7 @@ jobs:
           fetch-depth: 0  # tags are required to determine the version
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 623dcfdbb..a6cef0cec 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -24,7 +24,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.14'
 
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index 95b09e0cf..9289c44ac 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -11,4 +11,5 @@ rules:
         astral-sh/ruff-action: ref-pin
         codecov/codecov-action: ref-pin
         actions/create-github-app-token: ref-pin
+        actions/setup-python: ref-pin
         "*": hash-pin