diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c3905903..937cc796 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -413,7 +413,7 @@ jobs:
           sudo install "/tmp/d2-v${D2_VERSION}/bin/d2" /usr/local/bin/d2
       - name: Install Svgbob (pinned)
         run: cargo install svgbob_cli --version "${SVGBOB_VERSION}" --locked
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
       - name: Install Node renderers (bytefield-svg, pinned)
diff --git a/.github/workflows/release-bindings.yml b/.github/workflows/release-bindings.yml
index 3cc86b4e..328c9e67 100644
--- a/.github/workflows/release-bindings.yml
+++ b/.github/workflows/release-bindings.yml
@@ -291,7 +291,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with: { persist-credentials: false }
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with: { node-version: "24", package-manager-cache: false }
       - run: npm test
         working-directory: bindings/javascript
@@ -534,7 +534,7 @@ jobs:
     environment: npm
     permissions: { id-token: write }
     steps:
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with: { node-version: "24", registry-url: "https://registry.npmjs.org", package-manager-cache: false }
       - uses: actions/download-artifact@v7
         with: { name: npm-package, path: dist }