diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 147779886..3eee77e3b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,7 +44,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       # QNBS-v3: pnpm/setup instead of pnpm/action-setup, mirroring .github/actions/setup/action.yml (duplicated because this job predates the trust boundary it validates and can't use that composite).
-      - uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+      - uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
         with:
           version: 11.22.0
           install: false
diff --git a/.github/workflows/reviewer-governance-trust.yml b/.github/workflows/reviewer-governance-trust.yml
index 1134ae399..d43b18fc7 100644
--- a/.github/workflows/reviewer-governance-trust.yml
+++ b/.github/workflows/reviewer-governance-trust.yml
@@ -19,7 +19,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+      - uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
         with:
           version: 11.22.0
           install: false