diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml
index c012991b3a..ef5c68d191 100644
--- a/.forgejo/workflows/build-release.yml
+++ b/.forgejo/workflows/build-release.yml
@@ -43,8 +43,7 @@ jobs:
 
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.21"
-          check-latest: true
+          go-version: "1.21.8"
 
       - name: version from ref
         id: release-info
diff --git a/.forgejo/workflows/cascade-setup-end-to-end.yml b/.forgejo/workflows/cascade-setup-end-to-end.yml
index 85871ec31d..b8269e1d35 100644
--- a/.forgejo/workflows/cascade-setup-end-to-end.yml
+++ b/.forgejo/workflows/cascade-setup-end-to-end.yml
@@ -67,7 +67,7 @@ jobs:
           chown -R forgejo:forgejo .
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.21"
+          go-version: "1.21.8"
       - name: make deps-backend
         run: |
           su forgejo -c 'make deps-backend'
diff --git a/.forgejo/workflows/e2e.yml b/.forgejo/workflows/e2e.yml
index 2104f6a067..7ace817bc1 100644
--- a/.forgejo/workflows/e2e.yml
+++ b/.forgejo/workflows/e2e.yml
@@ -17,8 +17,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v4
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "~1.21"
-          check-latest: true
+          go-version: "1.21.8"
       - run: |
           apt-get -qq update
           apt-get -qq install -q sudo
diff --git a/.forgejo/workflows/publish-release.yml b/.forgejo/workflows/publish-release.yml
index eaa14c3693..68fb68eb75 100644
--- a/.forgejo/workflows/publish-release.yml
+++ b/.forgejo/workflows/publish-release.yml
@@ -64,7 +64,7 @@ jobs:
         if: vars.ROLE == 'forgejo-experimental' && secrets.OVH_APP_KEY != ''
         uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.21"
+          go-version: "1.21.8"
           check-latest: true
       - name: update the _release.experimental DNS record
         if: vars.ROLE == 'forgejo-experimental' && secrets.OVH_APP_KEY != ''
diff --git a/.forgejo/workflows/testing.yml b/.forgejo/workflows/testing.yml
index 80fd87152e..1bc23e16b0 100644
--- a/.forgejo/workflows/testing.yml
+++ b/.forgejo/workflows/testing.yml
@@ -17,7 +17,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v3
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.21"
+          go-version: "1.21.8"
           check-latest: true
       - run: make deps-backend deps-tools
       - run: make --always-make -j$(nproc) lint-backend checks-backend # ensure the "go-licenses" make target runs
@@ -51,7 +51,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v3
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.21"
+          go-version: "1.21.8"
       - run: |
           git config --add safe.directory '*'
           adduser --quiet --comment forgejo --disabled-password forgejo
@@ -96,7 +96,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v3
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.21"
+          go-version: "1.21.8"
       - name: install dependencies & git >= 2.42
         run: |
           export DEBIAN_FRONTEND=noninteractive
@@ -143,7 +143,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v3
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.21"
+          go-version: "1.21.8"
       - name: install dependencies & git >= 2.42
         run: |
           export DEBIAN_FRONTEND=noninteractive
@@ -180,7 +180,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v3
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.21"
+          go-version: "1.21.8"
       - name: install dependencies & git >= 2.42
         run: |
           export DEBIAN_FRONTEND=noninteractive