diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4021859..843b2e1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Node.js 24
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24.x
           cache: npm
@@ -75,7 +75,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Set up Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
@@ -112,7 +112,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Node.js 22
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22.x
           cache: npm
@@ -134,7 +134,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Node.js 24
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24.x
           cache: npm
@@ -154,7 +154,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Node.js 26
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 26.x
           cache: npm
@@ -181,7 +181,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Node.js 24
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24.x
           cache: npm
diff --git a/.github/workflows/live-smoke.yml b/.github/workflows/live-smoke.yml
index 3674ab7..296ecb7 100644
--- a/.github/workflows/live-smoke.yml
+++ b/.github/workflows/live-smoke.yml
@@ -29,7 +29,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Node.js 24
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24.x
           cache: npm
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7fbe8d6..76c617b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -82,7 +82,7 @@ jobs:
 
           echo "release-commit=${release_commit}" >> "$GITHUB_OUTPUT"
       - name: Set up Node.js 24
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24.x
           cache: npm
@@ -163,7 +163,7 @@ jobs:
           persist-credentials: false
           ref: ${{ needs.verify.outputs.release-commit }}
       - name: Set up Node.js 24
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24.x
           cache: npm
@@ -204,9 +204,10 @@ jobs:
           persist-credentials: false
           ref: ${{ needs.verify.outputs.release-commit }}
       - name: Set up Node.js 24
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24.x
+          package-manager-cache: false
           registry-url: https://registry.npmjs.org
       - name: Use a Trusted Publishing-capable npm CLI
         run: npm install --global npm@11.12.1
diff --git a/scripts/publish-artifact.sh b/scripts/publish-artifact.sh
index 3a7486c..0eb3c32 100644
--- a/scripts/publish-artifact.sh
+++ b/scripts/publish-artifact.sh
@@ -7,11 +7,7 @@ set -euo pipefail
 
 artifact_directory="${ARTIFACT_DIRECTORY:-release-artifacts}"
 
-# actions/setup-node exports this fixed sentinel when registry-url is configured,
-# including the npm-documented Trusted Publishing workflow.
-setup_node_auth_placeholder="XXXXX-XXXXX-XXXXX-XXXXX"
-if [[ -n "${NPM_TOKEN:-}" ]] || \
-  [[ -n "${NODE_AUTH_TOKEN:-}" && "${NODE_AUTH_TOKEN}" != "$setup_node_auth_placeholder" ]]; then
+if [[ -n "${NPM_TOKEN:-}" ]] || [[ -n "${NODE_AUTH_TOKEN:-}" ]]; then
   echo "Registry tokens are forbidden; publication must use npm Trusted Publishing." >&2
   exit 1
 fi
diff --git a/tests/publish-artifact.test.mjs b/tests/publish-artifact.test.mjs
index b3ad333..fb50670 100644
--- a/tests/publish-artifact.test.mjs
+++ b/tests/publish-artifact.test.mjs
@@ -18,7 +18,6 @@ import { afterEach, describe, expect, it } from "vitest";
 const script = fileURLToPath(
   new URL("../scripts/publish-artifact.sh", import.meta.url),
 );
-const setupNodeAuthPlaceholder = "XXXXX-XXXXX-XXXXX-XXXXX";
 const temporaryDirectories = [];
 
 afterEach(() => {
@@ -97,17 +96,11 @@ describe("publish artifact authentication", () => {
     );
   });
 
-  it("allows the actions/setup-node authentication placeholder", () => {
-    const { log, result } = runPublish({
-      nodeAuthToken: setupNodeAuthPlaceholder,
-    });
-    expect(result.status, result.stderr).toBe(0);
-    expect(log).toMatch(
-      /^token-present\npublish .* --provenance --tag next\n$/,
-    );
-  });
-
   it.each([
+    [
+      "NODE_AUTH_TOKEN setup-node sentinel",
+      { nodeAuthToken: "XXXXX-XXXXX-XXXXX-XXXXX" },
+    ],
     ["NODE_AUTH_TOKEN", { nodeAuthToken: "opaque" }],
     ["NPM_TOKEN", { npmToken: "opaque" }],
   ])("rejects the %s registry credential", (_name, options) => {
diff --git a/tests/workflow-contract.test.mjs b/tests/workflow-contract.test.mjs
index be997cf..b940b7b 100644
--- a/tests/workflow-contract.test.mjs
+++ b/tests/workflow-contract.test.mjs
@@ -116,6 +116,9 @@ describe("GitHub Actions workflow contract", () => {
     expect(publishWorkflow).not.toContain("NPM_ALPHA1_BOOTSTRAP");
     expect(publishWorkflow).not.toContain("recover-verify");
     expect(publishWorkflow).not.toContain("recover-publish");
+    expect(publish).toMatch(
+      /package-manager-cache: false\n {10}registry-url: https:\/\/registry\.npmjs\.org/,
+    );
   });
 
   it("pins third-party actions and disables checkout credential persistence", () => {