diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9bf2017..8f53eed 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -24,7 +24,7 @@ jobs:
 
       # No `cache: npm`: the cache key hashes a lockfile this package
       # deliberately does not ship, and the step errors out without one.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: lts/*