diff --git a/.github/workflows/changesets.yml b/.github/workflows/changesets.yml
index 88de041..a0e4102 100644
--- a/.github/workflows/changesets.yml
+++ b/.github/workflows/changesets.yml
@@ -40,7 +40,7 @@ jobs:
           run_install: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "22"
           cache: "pnpm"
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 512e3bd..dc50528 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -65,7 +65,7 @@ jobs:
         # `_authToken=${NODE_AUTH_TOKEN}` line into ~/.npmrc, which then
         # short-circuits the trusted-publisher OIDC handshake when no token is
         # present. The npm publish step passes --registry explicitly instead.
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "24"
           cache: "pnpm"
@@ -140,7 +140,7 @@ jobs:
           echo "npm — published: $published  skipped: $skipped"
 
       - name: Setup Node.js (GitHub Packages registry)
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1f40d21..b6049c8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -50,7 +50,7 @@ jobs:
           fetch-depth: 1
 
       - name: Setup Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node }}