diff --git a/.github/workflows/docs-checks.yml b/.github/workflows/docs-checks.yml
index a1693ff9..f7244211 100644
--- a/.github/workflows/docs-checks.yml
+++ b/.github/workflows/docs-checks.yml
@@ -37,7 +37,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
 
@@ -96,7 +96,7 @@ jobs:
       # to satisfy Astro's floor (>= 22.12 for Astro 7); this is the repo's
       # `engines` floor.
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
 
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 3f0f29a3..afcb9f8c 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -67,7 +67,7 @@ jobs:
       # system Node has to satisfy Astro's minimum (>= 22.12 for Astro 7).
       # We install the repo's `engines` floor.
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
 
diff --git a/.github/workflows/examples.yml b/.github/workflows/examples.yml
index 1ecf85f5..d28ff9ef 100644
--- a/.github/workflows/examples.yml
+++ b/.github/workflows/examples.yml
@@ -161,7 +161,7 @@ jobs:
       # need 24.15 or newer.  `node-version: '24'` resolves to the latest
       # 24.x and satisfies that; pinning a narrower 24.x would not.
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           cache: npm
diff --git a/.github/workflows/multi-runtime.yml b/.github/workflows/multi-runtime.yml
index d436509b..3fbfcf52 100644
--- a/.github/workflows/multi-runtime.yml
+++ b/.github/workflows/multi-runtime.yml
@@ -103,7 +103,7 @@ jobs:
       # 24 deliberately — it is the `engines` floor we claim to support.
       - name: Setup Node.js
         if: matrix.runtime == 'node'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
 
@@ -246,7 +246,7 @@ jobs:
         run: bun run smoke:bun
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
       - name: Build (tsc -> dist/)
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 75ce2ebc..fd553b01 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -91,7 +91,7 @@ jobs:
       # Node 24 (the `engines` floor) bundles npm >= 11.5.1, which is the
       # minimum for trusted publishing — no separate npm upgrade step needed.
       - name: Setup Node + npm registry
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'