diff --git a/.github/workflows/backend-tests.yml b/.github/workflows/backend-tests.yml
index 8617215..a04d7ee 100644
--- a/.github/workflows/backend-tests.yml
+++ b/.github/workflows/backend-tests.yml
@@ -30,7 +30,7 @@ jobs:
         name: Install Node.js
         with:
           node-version: 25
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.0.9
         name: Install pnpm
         with:
           version: 10
diff --git a/.github/workflows/frontend-tests.yml b/.github/workflows/frontend-tests.yml
index 0a98ce8..3b86b36 100644
--- a/.github/workflows/frontend-tests.yml
+++ b/.github/workflows/frontend-tests.yml
@@ -20,7 +20,7 @@ jobs:
         name: Install Node.js
         with:
           node-version: 25
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.0.9
         name: Install pnpm
         with:
           version: 10
diff --git a/.github/workflows/npmpublish.yml b/.github/workflows/npmpublish.yml
index 21e7236..5056e80 100644
--- a/.github/workflows/npmpublish.yml
+++ b/.github/workflows/npmpublish.yml
@@ -31,7 +31,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           repository: ether/etherpad-lite
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.0.9
         name: Install pnpm
         with:
           version: 10
@@ -74,7 +74,7 @@ jobs:
           # `pnpm version patch` bumps package.json, makes a commit, and creates
           # a `v<new-version>` tag. Capture the new tag name from package.json
           # rather than parsing pnpm's output, which has historically varied.
-          # Bump the patch component directly with Node. pnpm/action-setup@v6
+          # Bump the patch component directly with Node. pnpm/action-setup@v6.0.9
           # sometimes installs pnpm 11 pre-releases even when version: 10.x is
           # requested (pnpm/action-setup#225); those pre-releases either skip
           # the git commit/tag or reject --no-git-tag-version as unknown.