diff --git a/.github/workflows/publish-bundle.yml b/.github/workflows/publish-bundle.yml
index 888279a..a00d51e 100644
--- a/.github/workflows/publish-bundle.yml
+++ b/.github/workflows/publish-bundle.yml
@@ -65,7 +65,7 @@ jobs:
 
       - name: Download bundles from this build attempt
         if: steps.request.outputs.ready == 'true'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: rebuilt-bundles-${{ github.event.workflow_run.run_attempt }}
           path: ${{ runner.temp }}/rebuilt-bundles
diff --git a/.github/workflows/rebuild-bundle.yml b/.github/workflows/rebuild-bundle.yml
index 7479c7f..037a31c 100644
--- a/.github/workflows/rebuild-bundle.yml
+++ b/.github/workflows/rebuild-bundle.yml
@@ -39,7 +39,7 @@ jobs:
       # pnpm version is read from package.json's packageManager field.
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .node-version
           cache: pnpm
@@ -51,7 +51,7 @@ jobs:
         run: pnpm build
 
       - name: Upload rebuilt bundles
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rebuilt-bundles-${{ github.run_attempt }}
           path: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c7275a7..3e4c91a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -220,7 +220,7 @@ jobs:
           node test/reuse-installation-snapshot.mjs "$VP_HOME/current" > "$RUNNER_TEMP/reuse-before.json"
           # Preserve symlinks, permissions, and nanosecond timestamps across jobs.
           tar --format=posix -czf "$RUNNER_TEMP/reuse-installation.tar.gz" -C "$VP_HOME" .
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: reuse-installation
           path: |
@@ -237,7 +237,7 @@ jobs:
       VP_PR_VERSION: ""
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: reuse-installation
           path: ${{ runner.temp }}
@@ -1112,7 +1112,7 @@ jobs:
       contents: read
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24.15.0
       - name: Verify repeated saves with Bun-style directory symlinks