diff --git a/.github/workflows/backend-tests.yml b/.github/workflows/backend-tests.yml
index f3490ec..5b433dc 100644
--- a/.github/workflows/backend-tests.yml
+++ b/.github/workflows/backend-tests.yml
@@ -30,7 +30,7 @@ jobs:
         name: Install Node.js
         with:
           node-version: 25
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.0.9
         name: Install pnpm
         with:
           package_json_file: ./etherpad-lite/package.json
diff --git a/.github/workflows/frontend-tests.yml b/.github/workflows/frontend-tests.yml
index 27f8035..d9282c4 100644
--- a/.github/workflows/frontend-tests.yml
+++ b/.github/workflows/frontend-tests.yml
@@ -20,7 +20,7 @@ jobs:
         name: Install Node.js
         with:
           node-version: 25
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.0.9
         name: Install pnpm
         with:
           package_json_file: ./etherpad-lite/package.json
diff --git a/.github/workflows/npmpublish.yml b/.github/workflows/npmpublish.yml
index c66b640..5752d38 100644
--- a/.github/workflows/npmpublish.yml
+++ b/.github/workflows/npmpublish.yml
@@ -31,7 +31,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           repository: ether/etherpad-lite
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.0.9
         name: Install pnpm
         with:
           run_install: false
@@ -73,7 +73,7 @@ jobs:
           # `pnpm version patch` bumps package.json, makes a commit, and creates
           # a `v<new-version>` tag. Capture the new tag name from package.json
           # rather than parsing pnpm's output, which has historically varied.
-          # Bump the patch component directly with Node. pnpm/action-setup@v6
+          # Bump the patch component directly with Node. pnpm/action-setup@v6.0.9
           # sometimes installs pnpm 11 pre-releases even when version: 10.x is
           # requested (pnpm/action-setup#225); those pre-releases either skip
           # the git commit/tag or reject --no-git-tag-version as unknown.