diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aa568795..21aae94c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -244,7 +244,7 @@ jobs:
       - uses: pnpm/action-setup@v6.1.0 # reads packageManager from package.json
         if: needs.changes.result != 'success' || needs.changes.outputs.frontend == 'true'
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         if: needs.changes.result != 'success' || needs.changes.outputs.frontend == 'true'
         with:
           node-version-file: .nvmrc
@@ -321,7 +321,7 @@ jobs:
       - uses: pnpm/action-setup@v6.1.0 # reads packageManager from package.json
         if: needs.changes.result != 'success' || needs.changes.outputs.frontend == 'true'
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         if: needs.changes.result != 'success' || needs.changes.outputs.frontend == 'true'
         with:
           node-version-file: .nvmrc
@@ -419,7 +419,7 @@ jobs:
       - uses: pnpm/action-setup@v6.1.0 # reads packageManager from package.json
         if: needs.changes.result != 'success' || needs.changes.outputs.frontend == 'true'
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         if: needs.changes.result != 'success' || needs.changes.outputs.frontend == 'true'
         with:
           node-version-file: .nvmrc
@@ -484,7 +484,7 @@ jobs:
       - uses: pnpm/action-setup@v6.1.0 # reads packageManager from package.json
         if: needs.changes.result != 'success' || needs.changes.outputs.frontend == 'true'
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         if: needs.changes.result != 'success' || needs.changes.outputs.frontend == 'true'
         with:
           node-version-file: .nvmrc
@@ -559,7 +559,7 @@ jobs:
       - uses: pnpm/action-setup@v6.1.0 # reads packageManager from package.json
         if: needs.changes.result != 'success' || needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         if: needs.changes.result != 'success' || needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
         with:
           node-version-file: .nvmrc
@@ -633,7 +633,7 @@ jobs:
       - uses: pnpm/action-setup@v6.1.0 # reads packageManager from package.json
         if: needs.changes.result != 'success' || needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         if: needs.changes.result != 'success' || needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
         with:
           node-version-file: .nvmrc
@@ -770,7 +770,7 @@ jobs:
       - uses: pnpm/action-setup@v6.1.0 # reads packageManager from package.json
         if: needs.changes.result != 'success' || needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         if: needs.changes.result != 'success' || needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
         with:
           node-version-file: .nvmrc
@@ -995,7 +995,7 @@ jobs:
 
       - uses: pnpm/action-setup@v6.1.0 # reads packageManager from package.json
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         with:
           node-version-file: .nvmrc
           cache: pnpm
@@ -1139,7 +1139,7 @@ jobs:
       - uses: pnpm/action-setup@v6.1.0 # reads packageManager from package.json
         if: needs.changes.result != 'success' || needs.changes.outputs.docs == 'true'
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         if: needs.changes.result != 'success' || needs.changes.outputs.docs == 'true'
         with:
           node-version-file: .nvmrc
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index fddfec3a..484bb7d6 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -90,7 +90,7 @@ jobs:
       # tag still points at a commit that cannot. reads packageManager from package.json
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version-file: .nvmrc
           cache: pnpm
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index fb148bb3..5e0d43d8 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -64,7 +64,7 @@ jobs:
       # reads packageManager from package.json
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version-file: .nvmrc
           cache: pnpm