diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fb3aebd3..13f05564 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,7 +34,7 @@ jobs:
           cache-dependency-path: backend/go_orchestrator/go.mod
 
       - name: Set up Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
 
diff --git a/.github/workflows/ignored-tests.yml b/.github/workflows/ignored-tests.yml
index 5b9cfaa4..fd1560d4 100644
--- a/.github/workflows/ignored-tests.yml
+++ b/.github/workflows/ignored-tests.yml
@@ -55,7 +55,7 @@ jobs:
         with:
           cache-on-failure: true
           workspaces: rust
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
       # Playwright is installed outside the repository, at a pinned version, so
@@ -91,7 +91,7 @@ jobs:
         with:
           cache-on-failure: true
           workspaces: rust
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
       - name: Install the claude CLI
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index e59f9478..003af8ef 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -33,7 +33,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
@@ -66,7 +66,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
@@ -116,7 +116,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
@@ -195,7 +195,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e7ebc185..0e9780d1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -61,7 +61,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
       # The gate is cmd/dcrelease, a standard-library Go command: it needs Go