diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 928c998c..32ab53ba 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,17 +41,17 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout repo
-      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         persist-credentials: false
     - name: Install Ruby ${{ matrix.ruby }}
       uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0
       with:
         ruby-version: "${{ matrix.ruby }}"
-    - name: Install NodeJS 18.x
-      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+    - name: Install NodeJS 24.x
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
-        node-version: "18.x"
+        node-version: "24.x"
     - name: Install dependencies
       shell: bash
       run: |
@@ -59,6 +59,7 @@ jobs:
         bundle install
     - name: Test ${{ matrix.task }}
       shell: bash
+      # zizmor: ignore[template-injection]
       run: |
         for task in $(echo "${{ matrix.task }}" | tr ',' ' '); do
           toys "$task" < /dev/null