diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6d0c5cbb..d8bc479a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -177,7 +177,7 @@ jobs:
         working-directory: sdk/typescript
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 336cc357..8649776c 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -67,7 +67,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1
 
       # pnpm audit reads pnpm-lock.yaml and needs no install; production
       # dependencies are the blocking gate (dev-only findings in the SDK