diff --git a/.github/workflows/validate-release-pr.yml b/.github/workflows/validate-release-pr.yml
index 4716bbd..2d79469 100644
--- a/.github/workflows/validate-release-pr.yml
+++ b/.github/workflows/validate-release-pr.yml
@@ -36,7 +36,7 @@ jobs:
       # rebuild toolchain to match promptfoo's release job (.nvmrc -> Node 24).
       - name: Set up Node.js
         if: ${{ startsWith(github.head_ref, 'release/code-scan-action-v') }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '24'