diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e1b2ef1..4cd5fd8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,7 +38,7 @@ jobs:
       # A second version would only exercise the toolchain again: the published
       # bundle is browser code with no Node API in it, and the suite runs in
       # jsdom, so nothing in either varies by Node version.
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b82dcc2..01a1556 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,7 +45,7 @@ jobs:
       # such package" rather than "not authenticated". Leaving it out means an
       # auth problem can only surface as an auth problem. registry.npmjs.org is
       # the default registry anyway.
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm