diff --git a/.github/workflows/account-deletion-worker.yml b/.github/workflows/account-deletion-worker.yml
index 60d34f7ba..e7d7821fd 100644
--- a/.github/workflows/account-deletion-worker.yml
+++ b/.github/workflows/account-deletion-worker.yml
@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # actions/setup-node@v6
         with:
           node-version: '24'
 
diff --git a/.github/workflows/nightly-local-regression.yml b/.github/workflows/nightly-local-regression.yml
index ca8bdb163..e43c73beb 100644
--- a/.github/workflows/nightly-local-regression.yml
+++ b/.github/workflows/nightly-local-regression.yml
@@ -50,7 +50,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Node 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # actions/setup-node@v6
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
diff --git a/.github/workflows/nightly-regression.yml b/.github/workflows/nightly-regression.yml
index b47b15d81..fd9a3908b 100644
--- a/.github/workflows/nightly-regression.yml
+++ b/.github/workflows/nightly-regression.yml
@@ -190,7 +190,7 @@ jobs:
       - uses: actions/checkout@v5
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
diff --git a/.github/workflows/privacy-retention.yml b/.github/workflows/privacy-retention.yml
index 178c2a13f..f2c823ce1 100644
--- a/.github/workflows/privacy-retention.yml
+++ b/.github/workflows/privacy-retention.yml
@@ -44,7 +44,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # actions/setup-node@v6
         with:
           node-version: '24'
 
diff --git a/.github/workflows/release-governance-ci.yml b/.github/workflows/release-governance-ci.yml
index 00bde9359..2da968e02 100644
--- a/.github/workflows/release-governance-ci.yml
+++ b/.github/workflows/release-governance-ci.yml
@@ -31,7 +31,7 @@ jobs:
         run: |
           test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
           test "$(git rev-parse HEAD^{tree})" = "$(git rev-parse "$EXPECTED_SHA^{tree}")"
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version: '24'
           cache: npm
diff --git a/.github/workflows/restaurant-refresh-cron.yml b/.github/workflows/restaurant-refresh-cron.yml
index 9a01c61d7..3a2ae74b5 100644
--- a/.github/workflows/restaurant-refresh-cron.yml
+++ b/.github/workflows/restaurant-refresh-cron.yml
@@ -63,7 +63,7 @@ jobs:
           test "$RESTAURANT_REFRESH_LIMIT" -le 500
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # actions/setup-node@v6
         with:
           node-version: '24'
           cache: npm
diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index 66647be2e..868c69e95 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -40,7 +40,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # actions/setup-node@v6
         with:
           node-version: '24'
           cache: 'npm'
@@ -108,7 +108,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # actions/setup-node@v6
         with:
           node-version: '24'
 
diff --git a/.github/workflows/supabase-migration-apply.yml b/.github/workflows/supabase-migration-apply.yml
index b9f1dc00e..03592d122 100644
--- a/.github/workflows/supabase-migration-apply.yml
+++ b/.github/workflows/supabase-migration-apply.yml
@@ -74,7 +74,7 @@ jobs:
           printf 'sha=%s\n' "$GITHUB_SHA" >> "$GITHUB_OUTPUT"
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # actions/setup-node@v6
         with:
           node-version: '24'
 
@@ -143,7 +143,7 @@ jobs:
           test "$actual_manifest_sha256" = "${{ needs.validate.outputs.manifest_sha256 }}"
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # actions/setup-node@v6
         with:
           node-version: '24'
 
diff --git a/.github/workflows/web-admin-ci.yml b/.github/workflows/web-admin-ci.yml
index aa80c7f7e..d5f2ba43a 100644
--- a/.github/workflows/web-admin-ci.yml
+++ b/.github/workflows/web-admin-ci.yml
@@ -103,7 +103,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version: '24'
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -176,7 +176,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version: '24'
           cache: npm
@@ -231,7 +231,7 @@ jobs:
           path: web-bun
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version: '24'
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -281,7 +281,7 @@ jobs:
           path: web-npm
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version: '24'
           cache: npm
@@ -342,7 +342,7 @@ jobs:
           path: web-bun
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version: '24'
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -403,7 +403,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version: '24'
           cache: npm
diff --git a/.github/workflows/youtube-kpi-snapshot.yml b/.github/workflows/youtube-kpi-snapshot.yml
index fdfea5b24..9b1bc3b84 100644
--- a/.github/workflows/youtube-kpi-snapshot.yml
+++ b/.github/workflows/youtube-kpi-snapshot.yml
@@ -31,7 +31,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version: "24"
           cache: npm