diff --git a/.github/workflows/laravel-ci.yml b/.github/workflows/laravel-ci.yml
index a6b3916..85154e6 100644
--- a/.github/workflows/laravel-ci.yml
+++ b/.github/workflows/laravel-ci.yml
@@ -147,7 +147,7 @@ jobs:
 
       - &setup-php
         name: Set up PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ inputs.php-version }}
           extensions: ${{ inputs.php-extensions }}
@@ -196,7 +196,7 @@ jobs:
       - &setup-node
         name: Set up Node.js
         if: inputs.frontend || github.job == 'e2e'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ${{ inputs.node-version-file }}
           cache: npm
diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml
index 636dd8b..b0f0176 100644
--- a/.github/workflows/node-ci.yml
+++ b/.github/workflows/node-ci.yml
@@ -120,7 +120,7 @@ jobs:
 
       - &setup-node
         name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ inputs.node-version }}
           node-version-file: ${{ inputs.node-version == '' && inputs.node-version-file || '' }}
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 38603d4..a97fef9 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -206,7 +206,7 @@ jobs:
 
       - name: Set up PHP
         if: hashFiles(format('{0}/composer.lock', inputs.working-directory)) != ''
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ inputs.php-version }}
           coverage: none