diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml
index 2abe384..eca8a48 100644
--- a/.github/workflows/bump.yml
+++ b/.github/workflows/bump.yml
@@ -57,7 +57,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # full history + tags so "auto" can read commits since the last tag
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v6.4.0
         with:
           node-version: 22
           cache: npm
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7caf586..dfed152 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
         node: [20, 22]
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v6.4.0
         with:
           node-version: ${{ matrix.node }}
           cache: npm
diff --git a/.github/workflows/docs-links.yml b/.github/workflows/docs-links.yml
index 4a061ec..a1c647b 100644
--- a/.github/workflows/docs-links.yml
+++ b/.github/workflows/docs-links.yml
@@ -22,7 +22,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6.4.0
         with:
           node-version: "20"
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 70bfe68..16ea546 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,7 +39,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # full history so release notes can diff from the last tag
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v6.4.0
         with:
           node-version: 22
           registry-url: "https://registry.npmjs.org"
diff --git a/.github/workflows/reusable-quality-gate.yml b/.github/workflows/reusable-quality-gate.yml
index b1a0db6..22e0be2 100644
--- a/.github/workflows/reusable-quality-gate.yml
+++ b/.github/workflows/reusable-quality-gate.yml
@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # the docs CHANGELOG check compares src vs CHANGELOG.md commit times
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v6.4.0
         with:
           node-version: 22
           cache: npm
diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
index 991e3e1..07bf9e6 100644
--- a/.github/workflows/smoke.yml
+++ b/.github/workflows/smoke.yml
@@ -32,7 +32,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v6.4.0
         with:
           node-version: 22
           cache: npm
diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 033ff44..518b7dd 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -29,7 +29,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v6.4.0
         with:
           node-version: 22
       - name: Build site