diff --git a/.github/workflows/conventional-commit.yml b/.github/workflows/conventional-commit.yml
index 5fb15dd0de..79208cb219 100644
--- a/.github/workflows/conventional-commit.yml
+++ b/.github/workflows/conventional-commit.yml
@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
           package-manager-cache: false
diff --git a/.github/workflows/osv.yml b/.github/workflows/osv.yml
index e6ca3d6522..6095801538 100644
--- a/.github/workflows/osv.yml
+++ b/.github/workflows/osv.yml
@@ -25,7 +25,7 @@ jobs:
         with: { persist-credentials: false }
       - uses: pnpm/action-setup@9fd676a19091d4595eefd76e4bd31c97133911f1 # v4.2.0
         with: { version: 10.34.5, run_install: false }
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with: { node-version: '24.12.0', package-manager-cache: false }
       - run: pnpm install --frozen-lockfile
       - name: Reject expired, unowned, untracked, or overlong exceptions