diff --git a/.github/workflows/publish-portal.yml b/.github/workflows/publish-portal.yml
index c62bfb0..1674414 100644
--- a/.github/workflows/publish-portal.yml
+++ b/.github/workflows/publish-portal.yml
@@ -33,7 +33,7 @@ jobs:
       # is the canonical npm registry client; bun's npm publish path does not
       # reliably emit sigstore provenance attestations on GitHub-hosted runners.
       - name: Setup Node (for npm publish)
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: "https://registry.npmjs.org"