diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e56ee3e4..f43ed0dd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ jobs:
       - { uses: actions/checkout@v7, with: { persist-credentials: false } }
       # Node comes from the runner's toolcache (no download); pnpm/setup installs only pnpm
       - { uses: actions/setup-node@v7, with: { node-version: '24' } }
-      - { uses: pnpm/setup@v2, with: { cache: true } }
+      - { uses: pnpm/setup@v3, with: { cache: true } }
       - run: pnpm build
       - run: pnpm lint:ci
       # - run: pnpm typecheck # covered by oxlint typechecking
@@ -29,7 +29,7 @@ jobs:
     steps:
       - { uses: actions/checkout@v7, with: { persist-credentials: false } }
       - { uses: actions/setup-node@v7, with: { node-version: '24' } }
-      - { uses: pnpm/setup@v2, with: { cache: true } }
+      - { uses: pnpm/setup@v3, with: { cache: true } }
       - run: pnpm build
       - run: pnpm release
         env:
@@ -42,7 +42,7 @@ jobs:
     steps:
       - { uses: actions/checkout@v7, with: { persist-credentials: false } }
       - { uses: actions/setup-node@v7, with: { node-version: '24' } }
-      - { uses: pnpm/setup@v2, with: { cache: true } }
+      - { uses: pnpm/setup@v3, with: { cache: true } }
       - run: pnpm docs:build
       - name: publish docs to github pages
         uses: peaceiris/actions-gh-pages@v4