diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7327af69..bedf8f1b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
           # commit branch escape the diff and makes the gate non-deterministic.
           fetch-depth: 0
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24.21.0
           cache: npm
@@ -119,7 +119,7 @@ jobs:
       - name: Verify dependencies
         run: go mod verify
       - name: Set up Node for embedded assets
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24.21.0
           cache: npm
@@ -162,7 +162,7 @@ jobs:
           go-version-file: go.mod
           cache: true
       - name: Set up Node for embedded assets
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         if: matrix.shard == 'other'
         with:
           node-version: 24.21.0
@@ -243,7 +243,7 @@ jobs:
           go-version-file: go.mod
           cache: true
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24.21.0
       - name: Download shard coverage
@@ -302,7 +302,7 @@ jobs:
           go-version-file: go.mod
           cache: true
       - name: Set up Node for release-style inputs
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24.21.0
           cache: npm
@@ -401,7 +401,7 @@ jobs:
           go-version-file: go.mod
           cache: true
       - name: Set up Node for release-style inputs
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24.21.0
           cache: npm
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 96d88974..7b896fc0 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -32,7 +32,7 @@ jobs:
       - name: Check out source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version-file: .node-version
           cache: npm
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3ff2e477..abfb6379 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -83,7 +83,7 @@ jobs:
       - name: Verify pinned Naabu release
         run: ./scripts/verify-naabu-pin.sh
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
@@ -423,7 +423,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up Node for frontend manifest verification
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm