diff --git a/.github/workflows/release-npm.yml b/.github/workflows/release-npm.yml
index 55496a09..409fe377 100644
--- a/.github/workflows/release-npm.yml
+++ b/.github/workflows/release-npm.yml
@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
diff --git a/.github/workflows/test-javascript.yml b/.github/workflows/test-javascript.yml
index 092c3360..dad8e6f2 100644
--- a/.github/workflows/test-javascript.yml
+++ b/.github/workflows/test-javascript.yml
@@ -40,7 +40,7 @@ jobs:
           persist-credentials: false
 
       - name: with Node.js ${{ matrix.node-version }} on ${{ matrix.os }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: "npm"
diff --git a/.github/workflows/test-testdata.yml b/.github/workflows/test-testdata.yml
index 879c8e4e..0e235451 100644
--- a/.github/workflows/test-testdata.yml
+++ b/.github/workflows/test-testdata.yml
@@ -24,7 +24,7 @@ jobs:
       with:
         persist-credentials: false
 
-    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         cache: 'npm'
         cache-dependency-path: testdata/package-lock.json