diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 3087f31..aedddca 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -64,7 +64,7 @@ jobs:
           echo "Tag ${TAG} (${TAG_SHA}) is an ancestor of main - proceeding."
 
       - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
 
@@ -132,7 +132,7 @@ jobs:
           egress-policy: audit
 
       - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"