diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3702e16e..bc13ee3c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
           # Need full clone for `git ls-files` + `git show :path` patterns
           # used by check-no-redis-pubsub.mjs / check-hardcoded-agent-paths.mjs.
           fetch-depth: 0
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: npm
@@ -124,7 +124,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: npm
@@ -155,7 +155,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: npm
@@ -198,7 +198,7 @@ jobs:
           # GO-2026-5856, the crypto/tls advisory fixed in 1.26.5). Bump
           # this when govulncheck flags a newer one.
           go-version: '1.26.5'
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: npm
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 338ffe1a..a3844b72 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -140,7 +140,7 @@ jobs:
       # does the same npm ci before its own tsc/vite build). Node/Go toolchain
       # otherwise stay off the host: the four service binaries build inside
       # `docker run "$BUILDBASE_TAG" ...` in the script itself.
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         if: matrix.config == 'baseline'
         with:
           node-version: 20