diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml
index f8cd69850..474bcc07d 100644
--- a/.forgejo/workflows/build-release.yml
+++ b/.forgejo/workflows/build-release.yml
@@ -43,7 +43,7 @@ jobs:
 
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.22"
+          go-version: "1.22.2"
           check-latest: true
 
       - name: version from ref
diff --git a/.forgejo/workflows/e2e.yml b/.forgejo/workflows/e2e.yml
index c1321b0a8..82f282a38 100644
--- a/.forgejo/workflows/e2e.yml
+++ b/.forgejo/workflows/e2e.yml
@@ -17,7 +17,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v4
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.22"
+          go-version: "1.22.2"
           check-latest: true
       - run: |
           apt-get -qq update
diff --git a/.forgejo/workflows/publish-release.yml b/.forgejo/workflows/publish-release.yml
index 674c1c270..8723b8458 100644
--- a/.forgejo/workflows/publish-release.yml
+++ b/.forgejo/workflows/publish-release.yml
@@ -64,7 +64,7 @@ jobs:
         if: vars.ROLE == 'forgejo-experimental' && secrets.OVH_APP_KEY != ''
         uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.22"
+          go-version: "1.22.2"
           check-latest: true
       - name: update the _release.experimental DNS record
         if: vars.ROLE == 'forgejo-experimental' && secrets.OVH_APP_KEY != ''
diff --git a/.forgejo/workflows/testing.yml b/.forgejo/workflows/testing.yml
index 125cb798d..8cf5c92d8 100644
--- a/.forgejo/workflows/testing.yml
+++ b/.forgejo/workflows/testing.yml
@@ -22,7 +22,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v3
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.22"
+          go-version: "1.22.2"
           check-latest: true
       - run: make deps-backend deps-tools
       - run: make --always-make -j$(nproc) lint-backend checks-backend # ensure the "go-licenses" make target runs
@@ -57,7 +57,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v3
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.22"
+          go-version: "1.22.2"
       - run: |
           git config --add safe.directory '*'
           adduser --quiet --comment forgejo --disabled-password forgejo
@@ -102,7 +102,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v3
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.22"
+          go-version: "1.22.2"
       - name: install dependencies & git >= 2.42
         run: |
           export DEBIAN_FRONTEND=noninteractive
@@ -149,7 +149,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v3
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.22"
+          go-version: "1.22.2"
       - name: install dependencies & git >= 2.42
         run: |
           export DEBIAN_FRONTEND=noninteractive
@@ -186,7 +186,7 @@ jobs:
       - uses: https://code.forgejo.org/actions/checkout@v3
       - uses: https://code.forgejo.org/actions/setup-go@v4
         with:
-          go-version: "1.22"
+          go-version: "1.22.2"
       - name: install dependencies & git >= 2.42
         run: |
           export DEBIAN_FRONTEND=noninteractive