diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 594d0d8..69ed947 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -100,7 +100,7 @@ jobs:
       # needs a Node the runner image does not promise. The version
       # comes from the package's own declared floor rather than from a
       # number written here, so there is one place it lives.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: npm/package.json
       # windows-latest has no GNU Make: the runner image ships MSYS2 but
@@ -226,7 +226,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node }}
       # The wrapper's own dependencies, installed from the lockfile.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2690c61..2751aa9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -468,7 +468,7 @@ jobs:
       # The line also bought nothing when it worked: this publishes to the
       # default registry, which is where the package manager already
       # looks.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           # EXACT, NOT THE PACKAGE'S FLOOR. The floor is a range, and a
           # range resolves to whatever is newest on the morning of the