diff --git a/.github/workflows/codex-review.yml b/.github/workflows/codex-review.yml
index 0bf344b..a47a96f 100644
--- a/.github/workflows/codex-review.yml
+++ b/.github/workflows/codex-review.yml
@@ -34,7 +34,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: '22'
 
diff --git a/.github/workflows/coverage-floor.yml b/.github/workflows/coverage-floor.yml
index 8c707e4..3e7fc67 100644
--- a/.github/workflows/coverage-floor.yml
+++ b/.github/workflows/coverage-floor.yml
@@ -237,7 +237,7 @@ jobs:
         if: steps.detect.outputs.language == 'go'
         with:
           go-version: ${{ steps.detect.outputs.go_version }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         if: steps.detect.outputs.language == 'js'
         with:
           node-version: ${{ inputs.node_version || '20' }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 99c0b7e..9182e8b 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -155,7 +155,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "20"
           # `actions/setup-node` looks for the lock file at the repo root unless
diff --git a/.github/workflows/pr-classify.yml b/.github/workflows/pr-classify.yml
index 36b375a..3b2929f 100644
--- a/.github/workflows/pr-classify.yml
+++ b/.github/workflows/pr-classify.yml
@@ -38,7 +38,7 @@ jobs:
           fi
 
       - name: Setup Node
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: '22'
 
diff --git a/.github/workflows/prettier-autofix.yml b/.github/workflows/prettier-autofix.yml
index 41d8fb0..2f062ff 100644
--- a/.github/workflows/prettier-autofix.yml
+++ b/.github/workflows/prettier-autofix.yml
@@ -98,7 +98,7 @@ jobs:
           token: ${{ secrets.automerge_pat }}
           fetch-depth: 0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "20"
           # Cache only when a root lockfile exists (mirrors lint.yml — see
diff --git a/.github/workflows/tests-runner.yml b/.github/workflows/tests-runner.yml
index 616c8f2..205b4d3 100644
--- a/.github/workflows/tests-runner.yml
+++ b/.github/workflows/tests-runner.yml
@@ -243,7 +243,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ inputs.node_version || '20' }}
       - name: Install runner (bun/pnpm) if needed