diff --git a/.github/workflows/mcp-release-watch.yml b/.github/workflows/mcp-release-watch.yml
index 57fde8c8d8..c4a8812720 100644
--- a/.github/workflows/mcp-release-watch.yml
+++ b/.github/workflows/mcp-release-watch.yml
@@ -27,7 +27,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
-          node-version: 24
+          node-version: 24.17.0
 
       - name: Check MCP release status
         env:
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index b0680869d5..4721e48a5d 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -29,7 +29,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
-          node-version: 24
+          node-version: 24.17.0
           registry-url: https://registry.npmjs.org
 
       - name: Verify release tag
diff --git a/.github/workflows/ui-preview-deploy.yml b/.github/workflows/ui-preview-deploy.yml
index 38bf95fcd8..d268f83442 100644
--- a/.github/workflows/ui-preview-deploy.yml
+++ b/.github/workflows/ui-preview-deploy.yml
@@ -63,7 +63,7 @@ jobs:
         if: steps.cfg.outputs.ready == 'true'
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
-          node-version: 22
+          node-version: 22.23.0
 
       - name: Install trusted Wrangler
         if: steps.cfg.outputs.ready == 'true'
@@ -182,7 +182,7 @@ jobs:
 
       - name: Record deployment for Reviewbot
         if: steps.cfg.outputs.ready == 'true' && steps.upload.outputs.preview_url != ''
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const url = ${{ toJSON(steps.upload.outputs.preview_url) }};
@@ -247,7 +247,7 @@ jobs:
         # spinner to a terminal "preview deploy failed" card, instead of waiting forever for a success
         # event that will never come. Gated on CF creds so a credential-less skip records nothing.
         if: failure() && steps.cfg.outputs.ready == 'true'
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const sha = context.payload.workflow_run.head_sha; // GitHub-set; never fork-supplied
diff --git a/.github/workflows/upstream-contract.yml b/.github/workflows/upstream-contract.yml
index dec3aa1a88..a9e7c19184 100644
--- a/.github/workflows/upstream-contract.yml
+++ b/.github/workflows/upstream-contract.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
-          node-version: 24
+          node-version: 24.17.0
           cache: npm
 
       - name: Install dependencies