diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index bd00c8b..b1f007c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
-      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: src/.nvmrc
       # the builder's own dev deps (jest for the script tests, eslint)
diff --git a/.github/workflows/update_cap.yml b/.github/workflows/update_cap.yml
index ab7bb2a..e909096 100644
--- a/.github/workflows/update_cap.yml
+++ b/.github/workflows/update_cap.yml
@@ -39,7 +39,7 @@ jobs:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: main
-      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           # from src/.nvmrc — the app's own declared runtime, so the nightly
           # and the published app can never disagree on the Node version