diff --git a/.github/workflows/semantic-release.yml b/.github/workflows/semantic-release.yml
index 165e167..180e765 100644
--- a/.github/workflows/semantic-release.yml
+++ b/.github/workflows/semantic-release.yml
@@ -43,7 +43,7 @@ jobs:
       # not trigger downstream workflows -- the @semantic-release/git commit
       # carries [skip ci] anyway, so nothing is lost.
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -51,9 +51,9 @@ jobs:
           persist-credentials: true
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
-          node-version: '22'
+          node-version: '24'
 
       - name: Install semantic-release
         run: |