diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 9a781ef7..37d77d5c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -261,7 +261,7 @@ jobs:
           cp sqlite-compiled/sqlite3mc.wasm sqlite3_web/extra/js-package/assets/
 
       - name: Setup node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v6.4.0
         with:
           node-version: latest
           package-manager-cache: false
@@ -426,7 +426,7 @@ jobs:
           dart run tool/hook_overrides.dart compiled
 
       - name: Android emulator tests
-        uses: reactivecircus/android-emulator-runner@e89f39f1abbbd05b1113a29cf4db69e7540cae5a # v2.37.0
+        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
         with:
           api-level: 34
           force-avd-creation: false
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1b8f8fee..00d78bc2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -152,7 +152,7 @@ jobs:
         cp sqlite-compiled/sqlite3mc.wasm sqlite3_web/extra/js-package/assets/
 
     - name: Setup node
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@v6.4.0
       with:
         node-version: latest
         package-manager-cache: false