diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 7a49345..33a17df 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with: { node-version: "20" }
       - run: npm ci
       # Placeholder para fuzz real; mantener job verde
diff --git a/.github/workflows/ts-ci-badge.yml b/.github/workflows/ts-ci-badge.yml
index a04862b..24c8ae8 100644
--- a/.github/workflows/ts-ci-badge.yml
+++ b/.github/workflows/ts-ci-badge.yml
@@ -5,6 +5,6 @@ jobs:
   badge:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-node@89d709d423dc495668cd762a18dd4a070611be3f
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903
         with: { node-version: "20" }
       - run: node -v && npm -v
diff --git a/.github/workflows/ts-ci.yml b/.github/workflows/ts-ci.yml
index 2660d9e..9abe57b 100644
--- a/.github/workflows/ts-ci.yml
+++ b/.github/workflows/ts-ci.yml
@@ -52,7 +52,7 @@ jobs:
             echo "has_pkg=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: actions/setup-node@89d709d423dc495668cd762a18dd4a070611be3f
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903
         if: ${{ steps.guard.outputs.has_pkg == 'true' }}
         with:
           node-version: ${{ matrix.node }}