diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0ba4b5ed..0430b43b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -63,7 +63,7 @@ jobs:
           addlicense -check -y "2024-2030" -ignore 'gen_proto/**' -ignore 'web/**/node_modules/**' -ignore 'web/**/dist/**' .
 
       - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           # Single source of truth: .nvmrc. The Dockerfile and
           # cloudbuild-bootstrap.yaml pin the same major, and