diff --git a/.github/workflows/aeon.yml b/.github/workflows/aeon.yml
index 92b8405c3b..390910f14a 100644
--- a/.github/workflows/aeon.yml
+++ b/.github/workflows/aeon.yml
@@ -142,7 +142,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.work.outputs.mode != ''
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
 
@@ -835,7 +835,7 @@ jobs:
       - name: Attest skill execution
         if: steps.attest-gate.outputs.attest == 'true'
         # Pinned to the current major per this repo's supply-chain convention
-        # (checkout@v7, setup-node@v6). Latest major confirmed at:
+        # (checkout@v7, setup-node@v7). Latest major confirmed at:
         # https://github.com/actions/attest-build-provenance/releases
         # Multi-subject: one attestation over both run-scoped artifacts (the output
         # snapshot and its manifest). Both paths are ${GITHUB_RUN_ID}-unique, so the
diff --git a/.github/workflows/messages.yml b/.github/workflows/messages.yml
index 5e56b68ad3..d61d65fd64 100644
--- a/.github/workflows/messages.yml
+++ b/.github/workflows/messages.yml
@@ -368,7 +368,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.msg.outputs.source != ''
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '22'