diff --git a/.github/workflows/acceptance.yml b/.github/workflows/acceptance.yml
index e140b654..6cf82cc1 100644
--- a/.github/workflows/acceptance.yml
+++ b/.github/workflows/acceptance.yml
@@ -75,7 +75,7 @@ jobs:
       # terraform-plugin-testing downloads a Terraform binary at run time unless one is on the
       # PATH. Installing it here makes the version explicit and the run reproducible.
       - name: Set up Terraform
-        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
           # Pinned: the query, action-trigger and replace steps all need a modern CLI, and
           # "latest" would make a scheduled failure ambiguous between API drift and CLI
diff --git a/.github/workflows/codegen-verify.yml b/.github/workflows/codegen-verify.yml
index 669fe336..b6acba37 100644
--- a/.github/workflows/codegen-verify.yml
+++ b/.github/workflows/codegen-verify.yml
@@ -416,7 +416,7 @@ jobs:
           cache: true
 
       - name: Set up Terraform
-        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
           terraform_wrapper: false