diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1c56130b..e68f5265 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -53,7 +53,7 @@ jobs:
       # both errors "Multiple versions of pnpm specified". Node 24 matches the
       # deploy image and package engines.
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 24.18.0
           cache: pnpm
diff --git a/.github/workflows/deploy-dev.yml b/.github/workflows/deploy-dev.yml
index 3ccd38d8..ad6dc1ef 100644
--- a/.github/workflows/deploy-dev.yml
+++ b/.github/workflows/deploy-dev.yml
@@ -99,7 +99,7 @@ jobs:
             exit 1
           fi
           echo "Deploying immutable image ${IMAGE_NAME}@${IMAGE_DIGEST}"
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with: { node-version: 24.18.0 }
       # Install Node first: the self-hosted runner's system Node is not a
       # supported application runtime, and pnpm's installer invokes npm.