diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6a5a50c..c2dfc25 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with: { node-version: '22.18.0', cache: npm }
       - run: npm ci
       - run: npm test
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 83a0656..60d97ac 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,7 +18,7 @@ jobs:
         run: |
           version="$(tr -d '\r\n' < VERSION)"
           test "$GITHUB_REF_NAME" = "v$version"
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
           node-version: '22.18.0'
           cache: npm
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index ff47482..bc6761f 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -28,7 +28,7 @@ jobs:
         run: cargo install cargo-deny --locked
       - name: Check Rust licenses, bans, and sources
         run: cargo deny check
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
           node-version: '22.18.0'
       - run: npm ci