diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9ffbbe2..7c51994 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,7 +47,7 @@ jobs:
       - name: Run pre-commit hooks
         run: uv run pre-commit run --all-files
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: "22"
           cache: "npm"
@@ -148,7 +148,7 @@ jobs:
         with:
           enable-cache: true
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: "22"
           cache: "npm"
@@ -224,7 +224,7 @@ jobs:
         with:
           enable-cache: true
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: "22"
           cache: "npm"
diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml
index 00f2d21..9d17d51 100644
--- a/.github/workflows/dependency-audit.yml
+++ b/.github/workflows/dependency-audit.yml
@@ -68,7 +68,7 @@ jobs:
       # `!cancelled()` so this lane still reports when pip-audit fails — the
       # audits are independent ecosystems, and a Python finding must not hide
       # npm findings (observed live: a failing pip-audit step skipped this one).
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         if: ${{ !cancelled() }}
         with:
           node-version: "22"