diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9030e94..1d200e5 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -39,12 +39,12 @@ jobs:
       # pnpm version comes from `packageManager` in skill-harness/package.json.
       # Do not add a `version:` input here: the action errors when both are
       # set and disagree, and one source of truth is the point.
-      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           package_json_file: skill-harness/package.json
 
       # Node version comes from `engines.node` in the same package.json.
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: skill-harness/package.json
           cache: "pnpm"