diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 87cafc4..a7299cb 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -20,7 +20,7 @@ jobs:
           distribution: 'temurin'
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '18'
 
diff --git a/.github/workflows/publish-maven-snapshots.yml b/.github/workflows/publish-maven-snapshots.yml
index 1625559..00e854b 100644
--- a/.github/workflows/publish-maven-snapshots.yml
+++ b/.github/workflows/publish-maven-snapshots.yml
@@ -50,7 +50,7 @@ jobs:
           cache: "gradle"
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "18"
 
diff --git a/.github/workflows/release-from-notes.yml b/.github/workflows/release-from-notes.yml
index 46b7cab..672f724 100644
--- a/.github/workflows/release-from-notes.yml
+++ b/.github/workflows/release-from-notes.yml
@@ -436,7 +436,7 @@ jobs:
           cache: "gradle"
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "18"
 
@@ -522,7 +522,7 @@ jobs:
 
       # npm >= 11.5.1 is required for OIDC trusted publishing; Node 24 bundles it.
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"