diff --git a/.github/renovate.json b/.github/renovate.json
index 9c3e190d..0b30ad7a 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -116,6 +116,17 @@
       "depNameTemplate": "golang/go",
       "datasourceTemplate": "golang-version",
       "versioningTemplate": "semver"
+    },
+    {
+      "customType": "regex",
+      "description": "Track GO_VERSION in Actions workflows",
+      "fileMatch": ["^\\.github/workflows/.*\\.yml$"],
+      "matchStrings": [
+        "GO_VERSION: ['\"]?(?<currentValue>[\\d\\.]+)['\"]?"
+      ],
+      "depNameTemplate": "golang/go",
+      "datasourceTemplate": "golang-version",
+      "versioningTemplate": "semver"
     }
   ],
 
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 9f5e5c9a..deae86e5 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -20,7 +20,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GO_VERSION: '1.25.6'
+  GO_VERSION: '1.25.7'
   GOTOOLCHAIN: auto
 
 # Minimal permissions at workflow level; write permissions granted at job level for push only
diff --git a/.github/workflows/codecov-upload.yml b/.github/workflows/codecov-upload.yml
index b671e8db..47a9664a 100644
--- a/.github/workflows/codecov-upload.yml
+++ b/.github/workflows/codecov-upload.yml
@@ -19,7 +19,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GO_VERSION: '1.25.6'
+  GO_VERSION: '1.25.7'
   NODE_VERSION: '24.12.0'
   GOTOOLCHAIN: auto
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f7d9619d..f130a8ef 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -21,7 +21,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GO_VERSION: '1.25.6'
+  GO_VERSION: '1.25.7'
   GOTOOLCHAIN: auto
 
 permissions:
diff --git a/.github/workflows/e2e-tests-split.yml b/.github/workflows/e2e-tests-split.yml
index 6e7c40b1..f6480e28 100644
--- a/.github/workflows/e2e-tests-split.yml
+++ b/.github/workflows/e2e-tests-split.yml
@@ -53,7 +53,7 @@ on:
 
 env:
   NODE_VERSION: '20'
-  GO_VERSION: '1.25.6'
+  GO_VERSION: '1.25.7'
   GOTOOLCHAIN: auto
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository_owner }}/charon
diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml
index 85539354..185a84cc 100644
--- a/.github/workflows/nightly-build.yml
+++ b/.github/workflows/nightly-build.yml
@@ -15,7 +15,7 @@ on:
       default: "false"
 
 env:
-  GO_VERSION: '1.25.6'
+  GO_VERSION: '1.25.7'
   NODE_VERSION: '24.12.0'
   GOTOOLCHAIN: auto
   GHCR_REGISTRY: ghcr.io
diff --git a/.github/workflows/quality-checks.yml b/.github/workflows/quality-checks.yml
index 1189a034..2e5a3139 100644
--- a/.github/workflows/quality-checks.yml
+++ b/.github/workflows/quality-checks.yml
@@ -23,7 +23,7 @@ permissions:
   checks: write
 
 env:
-  GO_VERSION: '1.25.6'
+  GO_VERSION: '1.25.7'
   NODE_VERSION: '24.12.0'
   GOTOOLCHAIN: auto
 
diff --git a/.github/workflows/release-goreleaser.yml b/.github/workflows/release-goreleaser.yml
index 821d144b..33cde6b8 100644
--- a/.github/workflows/release-goreleaser.yml
+++ b/.github/workflows/release-goreleaser.yml
@@ -10,7 +10,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  GO_VERSION: '1.25.6'
+  GO_VERSION: '1.25.7'
   NODE_VERSION: '24.12.0'
   GOTOOLCHAIN: auto