diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b40271d..76ecfcf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,7 +42,7 @@ jobs:
 
       - uses: pnpm/action-setup@v4
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node }}
           cache: pnpm
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 41533a2..a8e5410 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,7 +40,7 @@ jobs:
       # such package" rather than "not authenticated". Leaving it out means an
       # auth problem can only surface as an auth problem. registry.npmjs.org is
       # the default registry anyway.
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm