diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml
index 0d3acea806..bd79703fe1 100644
--- a/.github/workflows/go-ci.yml
+++ b/.github/workflows/go-ci.yml
@@ -11,16 +11,15 @@ jobs:
   go-test:
     strategy:
       matrix:
-        go-version: ['1.25']
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@faf52423ec0d44c58f68e83b614bfcd99dded66f
         with:
-          go-version: ${{ matrix.go-version }}
+          go-version-file: '.tool-versions'
       - name: (Windows) Enable pulling Go modules from private sourcegraph/sourcegraph
         if: runner.os == 'Windows'
         run: git config --global url."https://$env:PRIVATE_TOKEN@github.com/sourcegraph/".insteadOf "https://github.com/sourcegraph/"
diff --git a/.github/workflows/go-lint.yml b/.github/workflows/go-lint.yml
index 7c99b5999f..4fe3c4fca4 100644
--- a/.github/workflows/go-lint.yml
+++ b/.github/workflows/go-lint.yml
@@ -14,9 +14,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@faf52423ec0d44c58f68e83b614bfcd99dded66f
         with:
-          go-version: '1.25'
+          go-version-file: '.tool-versions'
       - name: Enable pulling Go modules from private sourcegraph/sourcegraph
         run: git config --global url."https://${PRIVATE_TOKEN}@github.com/sourcegraph/".insteadOf "https://github.com/sourcegraph/"
       - run: ./dev/go-lint.sh
diff --git a/.github/workflows/goreleaser-check.yml b/.github/workflows/goreleaser-check.yml
index 45d5c46e47..43209622cd 100644
--- a/.github/workflows/goreleaser-check.yml
+++ b/.github/workflows/goreleaser-check.yml
@@ -17,9 +17,9 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@faf52423ec0d44c58f68e83b614bfcd99dded66f
         with:
-          go-version: '1.25'
+          go-version-file: '.tool-versions'
       - name: Enable pulling Go modules from private sourcegraph/sourcegraph
         run: git config --global url."https://${PRIVATE_TOKEN}@github.com/sourcegraph/".insteadOf "https://github.com/sourcegraph/"
       - name: Check GoReleaser config
diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index 72a4a0f825..588d5e9d90 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -179,9 +179,9 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@faf52423ec0d44c58f68e83b614bfcd99dded66f
         with:
-          go-version: 1.25
+          go-version-file: '.tool-versions'
       - name: Enable pulling Go modules from private sourcegraph/sourcegraph
         run: git config --global url."https://${PRIVATE_TOKEN}@github.com/sourcegraph/".insteadOf "https://github.com/sourcegraph/"
       - run: go test ./...
diff --git a/.github/workflows/pr-auditor.yml b/.github/workflows/pr-auditor.yml
index fe0862e021..c338878bd9 100644
--- a/.github/workflows/pr-auditor.yml
+++ b/.github/workflows/pr-auditor.yml
@@ -13,8 +13,8 @@ jobs:
         with:
           repository: 'sourcegraph/devx-service'
           token: ${{ secrets.PR_AUDITOR_TOKEN }}
-      - uses: actions/setup-go@v5
-        with: { go-version: '1.23' }
+      - uses: actions/setup-go@faf52423ec0d44c58f68e83b614bfcd99dded66f
+        with: { go-version-file: '.tool-versions' }
 
       - run: 'go run ./cmd/pr-auditor'
         env:
diff --git a/.github/workflows/scip.yml b/.github/workflows/scip.yml
index 2df5a1e5c1..2d380ae660 100644
--- a/.github/workflows/scip.yml
+++ b/.github/workflows/scip.yml
@@ -12,9 +12,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@faf52423ec0d44c58f68e83b614bfcd99dded66f
         with:
-          go-version: 1.25
+          go-version-file: '.tool-versions'
 
       - name: Set directory to safe for git
         run: git config --global --add safe.directory $GITHUB_WORKSPACE