diff --git a/.github/workflows/build-and-make.yaml b/.github/workflows/build-and-make.yaml
index 3036c9153..2ee5271cc 100644
--- a/.github/workflows/build-and-make.yaml
+++ b/.github/workflows/build-and-make.yaml
@@ -100,7 +100,7 @@ jobs:
               uses: actions/checkout@v7
 
             - name: Setup Node.js
-              uses: actions/setup-node@v7
+              uses: actions/setup-node@v7.1.0
               with:
                   node-version-file: '.nvmrc'
 
@@ -419,7 +419,7 @@ jobs:
               uses: pnpm/action-setup@v6.1.0
 
             - name: Setup Node.js
-              uses: actions/setup-node@v7
+              uses: actions/setup-node@v7.1.0
               with:
                   node-version-file: '.nvmrc'
                   cache: 'pnpm'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d25580c26..5a9f528ef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -101,7 +101,7 @@ jobs:
               uses: pnpm/action-setup@v6.1.0
 
             - name: Setup Node.js
-              uses: actions/setup-node@v7
+              uses: actions/setup-node@v7.1.0
               with:
                   node-version-file: '.nvmrc'
                   cache: 'pnpm'
@@ -143,7 +143,7 @@ jobs:
               uses: pnpm/action-setup@v6.1.0
 
             - name: Setup Node.js
-              uses: actions/setup-node@v7
+              uses: actions/setup-node@v7.1.0
               with:
                   node-version-file: '.nvmrc'
                   cache: 'pnpm'
@@ -313,7 +313,7 @@ jobs:
               uses: pnpm/action-setup@v6.1.0
 
             - name: Setup Node.js
-              uses: actions/setup-node@v7
+              uses: actions/setup-node@v7.1.0
               with:
                   node-version-file: '.nvmrc'
                   cache: 'pnpm'
@@ -382,7 +382,7 @@ jobs:
               uses: pnpm/action-setup@v6.1.0
 
             - name: Setup Node.js
-              uses: actions/setup-node@v7
+              uses: actions/setup-node@v7.1.0
               with:
                   node-version-file: '.nvmrc'
                   cache: 'pnpm'
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 93a615c45..1753ebf37 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -54,7 +54,7 @@ jobs:
     # commit checked out above (the modern default); JavaScript is
     # interpreted, so no build step is needed before analysis.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4.38.2
+      uses: github/codeql-action/init@v4.38.3
       with:
         languages: ${{ matrix.language }}
         # Excludes the localhost dev/E2E mock servers from analysis; see the
@@ -66,4 +66,4 @@ jobs:
         # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4.38.2
+      uses: github/codeql-action/analyze@v4.38.3
diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
index f6e7dec04..02b2c1490 100644
--- a/.github/workflows/deploy-website.yml
+++ b/.github/workflows/deploy-website.yml
@@ -30,7 +30,7 @@ jobs:
         uses: pnpm/action-setup@v6.1.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v7.1.0
         with:
           node-version-file: '.nvmrc'
           cache: 'pnpm'
diff --git a/.github/workflows/e2e-tests.yaml b/.github/workflows/e2e-tests.yaml
index 42bbd8f98..a1a47747f 100644
--- a/.github/workflows/e2e-tests.yaml
+++ b/.github/workflows/e2e-tests.yaml
@@ -70,7 +70,7 @@ jobs:
               uses: pnpm/action-setup@v6.1.0
 
             - name: Setup Node.js
-              uses: actions/setup-node@v7
+              uses: actions/setup-node@v7.1.0
               with:
                   node-version-file: '.nvmrc'
                   cache: 'pnpm'
@@ -148,7 +148,7 @@ jobs:
             - uses: actions/checkout@v7
 
             - name: Setup Node.js
-              uses: actions/setup-node@v7
+              uses: actions/setup-node@v7.1.0
               with:
                   node-version-file: '.nvmrc'
 
@@ -204,7 +204,7 @@ jobs:
               uses: pnpm/action-setup@v6.1.0
 
             - name: Setup Node.js
-              uses: actions/setup-node@v7
+              uses: actions/setup-node@v7.1.0
               with:
                   node-version-file: '.nvmrc'
                   cache: 'pnpm'
diff --git a/.github/workflows/performance-ratchet.yml b/.github/workflows/performance-ratchet.yml
index 857240120..344a3d1bf 100644
--- a/.github/workflows/performance-ratchet.yml
+++ b/.github/workflows/performance-ratchet.yml
@@ -46,7 +46,7 @@ jobs:
               uses: pnpm/action-setup@v6.1.0
 
             - name: Setup Node.js
-              uses: actions/setup-node@v7
+              uses: actions/setup-node@v7.1.0
               with:
                   node-version-file: '.nvmrc'
                   cache: 'pnpm'
@@ -103,7 +103,7 @@ jobs:
 
             # The ratchet scripts are dependency-free Node; no pnpm install.
             - name: Setup Node.js
-              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+              uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
               with:
                   node-version-file: '.nvmrc'
 
diff --git a/.github/workflows/refresh-windows-embedded-mpv-runtime.yaml b/.github/workflows/refresh-windows-embedded-mpv-runtime.yaml
index a944acea0..3ad76d276 100644
--- a/.github/workflows/refresh-windows-embedded-mpv-runtime.yaml
+++ b/.github/workflows/refresh-windows-embedded-mpv-runtime.yaml
@@ -33,7 +33,7 @@ jobs:
                   persist-credentials: false
 
             - name: Setup Node.js
-              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+              uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
               with:
                   node-version-file: '.nvmrc'