diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 237252ff..c36985a5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -284,7 +284,7 @@ jobs:
       # The version in package.json is synced by cut-release.yml when a release branch is created.
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4216c79d..af3c488a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -250,7 +250,7 @@ jobs:
           echo "VSIX version set to $VERSION (from tag $RELEASE_TAG)"
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
 
diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml
index ed9c23cc..49a8c3cd 100644
--- a/.github/workflows/staging.yml
+++ b/.github/workflows/staging.yml
@@ -156,7 +156,7 @@ jobs:
           echo "VSIX version set to $VERSION (from branch $BRANCH)"
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"