diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index abcd4b4..4fff9ff 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm
@@ -111,7 +111,7 @@ jobs:
         working-directory: tools/cv-detector/go
         run: go test ./...
       - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
       - name: Install TS detector dependencies
@@ -140,7 +140,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 24875cd..db03f52 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -30,7 +30,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm
diff --git a/.github/workflows/publish-cvfile-cv-detector-npm.yml b/.github/workflows/publish-cvfile-cv-detector-npm.yml
index 4d2681f..f385c86 100644
--- a/.github/workflows/publish-cvfile-cv-detector-npm.yml
+++ b/.github/workflows/publish-cvfile-cv-detector-npm.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           # Node 24 ships npm >= 11.5.1 (OIDC trusted publishing). No registry-url
           # (its empty _authToken placeholder would suppress OIDC).
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 83192eb..4d1bd51 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -29,7 +29,7 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.ref }}
       - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           # Node 24 ships npm >= 11.5.1, which implements OIDC trusted publishing.
           # No registry-url: it would write an .npmrc with an empty _authToken