diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d5483e4..1df17d0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ jobs:
       - uses: pnpm/action-setup@v6
         with:
           version: 10
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
       - run: pnpm install
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 57ef247..deb1395 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,7 +22,7 @@ jobs:
           version: 10
       # No registry-url: setup-node would write an .npmrc with a NODE_AUTH_TOKEN
       # placeholder that breaks OIDC. Default registry is what trusted publishing targets.
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
       # Trusted publishing needs npm CLI >= 11.5.1; pnpm delegates publish to it.