diff --git a/.github/workflows/agent-pipeline.yml b/.github/workflows/agent-pipeline.yml
index 5df0bc8..77a9606 100644
--- a/.github/workflows/agent-pipeline.yml
+++ b/.github/workflows/agent-pipeline.yml
@@ -36,7 +36,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -86,7 +86,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
diff --git a/.github/workflows/bot-interop-publish.yml b/.github/workflows/bot-interop-publish.yml
index 16438db..a27146d 100644
--- a/.github/workflows/bot-interop-publish.yml
+++ b/.github/workflows/bot-interop-publish.yml
@@ -32,7 +32,7 @@ jobs:
         working-directory: packages/bot-interop
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
           registry-url: 'https://npm.pkg.github.com'
diff --git a/.github/workflows/bot-interop.yml b/.github/workflows/bot-interop.yml
index 7a19fe0..845fb69 100644
--- a/.github/workflows/bot-interop.yml
+++ b/.github/workflows/bot-interop.yml
@@ -32,7 +32,7 @@ jobs:
         working-directory: packages/bot-interop
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
           registry-url: 'https://npm.pkg.github.com'
diff --git a/.github/workflows/build-site.yml b/.github/workflows/build-site.yml
index 45771e0..348c29c 100644
--- a/.github/workflows/build-site.yml
+++ b/.github/workflows/build-site.yml
@@ -78,7 +78,7 @@ jobs:
           test -f "$SPEC_PATH" || { echo "Spec file not found in repo: $SPEC_PATH"; exit 1; }
           echo "Validated CLIENT_ID and SPEC_PATH=$SPEC_PATH"
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
diff --git a/.github/workflows/deploy-to-vercel.yml b/.github/workflows/deploy-to-vercel.yml
index d98fe50..d744349 100644
--- a/.github/workflows/deploy-to-vercel.yml
+++ b/.github/workflows/deploy-to-vercel.yml
@@ -24,7 +24,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
diff --git a/.github/workflows/emit-handoff.yml b/.github/workflows/emit-handoff.yml
index 44c3243..93db8c5 100644
--- a/.github/workflows/emit-handoff.yml
+++ b/.github/workflows/emit-handoff.yml
@@ -19,7 +19,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
diff --git a/.github/workflows/memory-stack-dependency-gate.yml b/.github/workflows/memory-stack-dependency-gate.yml
index 7412a01..827c606 100644
--- a/.github/workflows/memory-stack-dependency-gate.yml
+++ b/.github/workflows/memory-stack-dependency-gate.yml
@@ -29,7 +29,7 @@ jobs:
   dependency-resolvable:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
           registry-url: 'https://npm.pkg.github.com'
diff --git a/.github/workflows/regen-lockfile.yml b/.github/workflows/regen-lockfile.yml
index 887cd51..a71cd17 100644
--- a/.github/workflows/regen-lockfile.yml
+++ b/.github/workflows/regen-lockfile.yml
@@ -29,7 +29,7 @@ jobs:
           # so the commit/push below has a current branch + upstream.
           ref: ${{ github.ref_name }}
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.0.0
         with:
           node-version: '20'
           registry-url: 'https://npm.pkg.github.com'