diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 80b6a53..a4f7a71 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020   # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1   # v7.1.0
         with:
           # Matches the engines floor in package.json. Testing the floor (not a newer
           # version) is what catches "works on 24, broken on 22".
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 58dfdf7..c6eec52 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -34,7 +34,7 @@ jobs:
       # Set up Node.js with the npm registry.
       # Node 24 ships an npm new enough for OIDC trusted publishing (>= 11.5.1).
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020   # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1   # v7.1.0
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'