diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index d826336..7cfc544 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -33,7 +33,7 @@ jobs:
       # Runs the hooks from .pre-commit-config.yaml rather than repeating them
       # here, so local and CI cannot drift. zizmor is skipped: it has its own
       # job below, which the ruleset requires by name.
-      - uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece  # v3.0.0
+      - uses: j178/prek-action@1382ad72dea72f9d53832f2bcb65b3e87a947204  # v3.0.1
         env:
           SKIP: zizmor
           # renovate: datasource=github-releases depName=j178/prek extractVersion=^v(?<version>.+)$
@@ -85,7 +85,7 @@ jobs:
           PNPM_VERSION: 12.10.1
         with:
           version: ${{ env.PNPM_VERSION }}
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         env:
           # renovate: datasource=node-version depName=node
           NODE_VERSION: 24.21.0
@@ -148,7 +148,7 @@ jobs:
       # The zizmor hook from .pre-commit-config.yaml, so its rev is the one zizmor pin. The
       # token lets zizmor run its online audits (impostor commits, known-vulnerable actions);
       # without one it skips them and still passes.
-      - uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece  # v3.0.0
+      - uses: j178/prek-action@1382ad72dea72f9d53832f2bcb65b3e87a947204  # v3.0.1
         env:
           GH_TOKEN: ${{ github.token }}
           # renovate: datasource=github-releases depName=j178/prek extractVersion=^v(?<version>.+)$
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 79ff907..5a8277d 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -35,7 +35,7 @@ jobs:
           PNPM_VERSION: 12.10.1
         with:
           version: ${{ env.PNPM_VERSION }}
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         env:
           # renovate: datasource=node-version depName=node
           NODE_VERSION: 24.21.0