diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b916e4d..ec38cdf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,7 +38,7 @@ jobs:
       - name: Setup Node 24
         # Node 24 aligns the runtime with the bumped @types/node (Node-26 line) from the major-deps
         # migration, so the types no longer describe APIs ahead of the runtime.
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: 24
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 50c3050..f7fd63d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,11 +20,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.37.3
         with:
           languages: javascript-typescript
           build-mode: none
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.37.3
         with:
           category: '/language:javascript-typescript'