diff --git a/.github/workflows/publish-release-npm-package.yml b/.github/workflows/publish-release-npm-package.yml
index 9ebe4d5..709d9fe 100644
--- a/.github/workflows/publish-release-npm-package.yml
+++ b/.github/workflows/publish-release-npm-package.yml
@@ -20,7 +20,7 @@ jobs:
               uses: actions/checkout@v4
 
             - name: 🔧 Yarn cache
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
               with:
                   cache: "yarn"
                   registry-url: "https://registry.npmjs.org"
diff --git a/.github/workflows/reusable-playwright-tests.yml b/.github/workflows/reusable-playwright-tests.yml
index f10d7d5..36a8681 100644
--- a/.github/workflows/reusable-playwright-tests.yml
+++ b/.github/workflows/reusable-playwright-tests.yml
@@ -18,7 +18,7 @@ jobs:
               with:
                   repository: ${{ inputs.webapp-artifact && 'element-hq/element-modules' || github.repository }}
 
-            - uses: actions/setup-node@v4
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
               with:
                   cache: "yarn"
                   node-version: "lts/*"
diff --git a/.github/workflows/static-analysis.yaml b/.github/workflows/static-analysis.yaml
index 1c87aef..a6e9ad6 100644
--- a/.github/workflows/static-analysis.yaml
+++ b/.github/workflows/static-analysis.yaml
@@ -26,7 +26,7 @@ jobs:
         steps:
             - uses: actions/checkout@v4
 
-            - uses: actions/setup-node@v4
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
               with:
                   cache: "yarn"
                   node-version: "lts/*"
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index a8d8d22..4b2ede4 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -16,7 +16,7 @@ jobs:
         steps:
             - uses: actions/checkout@v4
 
-            - uses: actions/setup-node@v4
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
               with:
                   cache: "yarn"
                   node-version: "lts/*"