diff --git a/.github/workflows/draft-github-release.yml b/.github/workflows/draft-github-release.yml
index 2e40c8e9a7..1af6cc3a62 100644
--- a/.github/workflows/draft-github-release.yml
+++ b/.github/workflows/draft-github-release.yml
@@ -14,7 +14,7 @@ jobs:
           # We need to fetch the full repository in order to write complete
           # release notes.
           fetch-depth: 0
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+      - uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
         with:
           node-version: current
       - name: Run Release Draft Script
diff --git a/.github/workflows/publish-on-npm.yml b/.github/workflows/publish-on-npm.yml
index a1c410b0d6..b3094cd9ae 100644
--- a/.github/workflows/publish-on-npm.yml
+++ b/.github/workflows/publish-on-npm.yml
@@ -20,7 +20,7 @@ jobs:
       # Install all deps in preparation for creating a release.
       # Unlike publishing, this is done using the normal NPM registry
       # to download deps.
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+      - uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
         with:
           node-version: current
       # TODO: We should check in a lockfile and use npm ci here instead.
@@ -29,7 +29,7 @@ jobs:
       # Re-setup node using Wombat Dressing Room as the registry
       # The actual NodeJS binaries and such are cached, so doing this
       # twice isn't particularly expensive.
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+      - uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
         with:
           node-version: current
           registry-url: https://wombat-dressing-room.appspot.com