diff --git a/.github/workflows/crates-publish.yml b/.github/workflows/crates-publish.yml
index ea1397e9..691c6170 100644
--- a/.github/workflows/crates-publish.yml
+++ b/.github/workflows/crates-publish.yml
@@ -301,7 +301,7 @@ jobs:
             -o /tmp/bsr-smoke/mkit-repo
 
       - name: Install Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '22'
 
diff --git a/.github/workflows/mcp-release.yml b/.github/workflows/mcp-release.yml
index 429a214e..9313bde2 100644
--- a/.github/workflows/mcp-release.yml
+++ b/.github/workflows/mcp-release.yml
@@ -79,7 +79,7 @@ jobs:
           fi
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '22'
 
diff --git a/.github/workflows/mcp.yml b/.github/workflows/mcp.yml
index dbcbe441..dc158784 100644
--- a/.github/workflows/mcp.yml
+++ b/.github/workflows/mcp.yml
@@ -67,7 +67,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '22'
 
diff --git a/.github/workflows/release-verify.yml b/.github/workflows/release-verify.yml
index e21431ba..8f598bc5 100644
--- a/.github/workflows/release-verify.yml
+++ b/.github/workflows/release-verify.yml
@@ -107,7 +107,7 @@ jobs:
           echo "version=${v}" >> "$GITHUB_OUTPUT"
 
       - name: Set up Node
-        uses: actions/setup-node@ea7bbbef9633bce3609c6f5cf537f4cf9a76c4d3  # v5
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v5
         with:
           node-version: "22"
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7ebe4390..8721a039 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -768,7 +768,7 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Node.js (npm registry)
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'
diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
index 25e1c9a6..2a2f4bf0 100644
--- a/.github/workflows/web.yml
+++ b/.github/workflows/web.yml
@@ -84,7 +84,7 @@ jobs:
       # Node stays: waku/vitest/wrangler run on the node runtime — bun is the
       # package manager and script runner only (see apps/web/README.md).
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: '22'