diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 1c12a13..94697c5 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -46,7 +46,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.13'
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d694817..b1abd52 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -50,7 +50,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.13'
 
@@ -115,7 +115,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.13'
 
@@ -195,7 +195,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.13'
 
@@ -241,7 +241,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         if: env.CODECOV_TOKEN != ''
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v7
         with:
           file: ${{ steps.python_layout.outputs.root }}/coverage.xml
           token: ${{ env.CODECOV_TOKEN }}
@@ -269,7 +269,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.13'
 
@@ -333,7 +333,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
 
@@ -419,7 +419,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.13'
 
@@ -531,7 +531,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.13'
 
diff --git a/changelog.d/20260722_issue_32_node24_actions.md b/changelog.d/20260722_issue_32_node24_actions.md
new file mode 100644
index 0000000..3f74910
--- /dev/null
+++ b/changelog.d/20260722_issue_32_node24_actions.md
@@ -0,0 +1,4 @@
+### Fixed
+
+- Upgrade the Python setup and Codecov workflow actions to Node 24-compatible
+  major versions and guard those pins with workflow policy tests.
diff --git a/tests/test_workflows.py b/tests/test_workflows.py
index 0ab23c7..8917fd3 100644
--- a/tests/test_workflows.py
+++ b/tests/test_workflows.py
@@ -95,8 +95,13 @@ def test_release_workflow_action_versions_are_current() -> None:
     release_workflow = read_workflow("release.yml")
 
     assert_action_pin_count(release_workflow, "actions/checkout", "v6", 7)
+    assert_action_pin_count(release_workflow, "actions/setup-python", "v6", 7)
     assert_action_pin_count(release_workflow, "actions/upload-artifact", "v7", 1)
     assert_action_pin_count(release_workflow, "actions/download-artifact", "v7", 1)
+    assert_action_pin_count(release_workflow, "codecov/codecov-action", "v7", 1)
+
+    assert_action_pin_absent(release_workflow, "actions/setup-python", "v5")
+    assert_action_pin_absent(release_workflow, "codecov/codecov-action", "v4")
 
 
 def test_release_workflow_sets_git_default_branch_before_checkout() -> None:
@@ -123,7 +128,7 @@ def test_release_workflow_gates_codecov_upload_on_token() -> None:
     assert "if: env.CODECOV_TOKEN == ''" in skip_step
     assert "::notice::" in skip_step
     assert "if: env.CODECOV_TOKEN != ''" in upload_step
-    assert "uses: codecov/codecov-action@v4" in upload_step
+    assert "uses: codecov/codecov-action@v7" in upload_step
     assert "file: ${{ steps.python_layout.outputs.root }}/coverage.xml" in upload_step
     assert "token: ${{ env.CODECOV_TOKEN }}" in upload_step
     assert "disable_search: true" in upload_step
@@ -231,12 +236,14 @@ def test_docs_workflow_action_versions_are_current() -> None:
     docs_workflow = read_workflow("docs.yml")
 
     assert_action_pin_count(docs_workflow, "actions/checkout", "v6", 1)
+    assert_action_pin_count(docs_workflow, "actions/setup-python", "v6", 1)
     assert_action_pin_count(docs_workflow, "actions/upload-artifact", "v7", 1)
     assert_action_pin_count(docs_workflow, "actions/configure-pages", "v6", 1)
     assert_action_pin_count(docs_workflow, "actions/upload-pages-artifact", "v5", 1)
     assert_action_pin_count(docs_workflow, "actions/deploy-pages", "v5", 1)
 
     assert_action_pin_absent(docs_workflow, "actions/checkout", "v4")
+    assert_action_pin_absent(docs_workflow, "actions/setup-python", "v5")
     assert_action_pin_absent(docs_workflow, "actions/upload-artifact", "v4")
     assert_action_pin_absent(docs_workflow, "actions/configure-pages", "v5")
     assert_action_pin_absent(docs_workflow, "actions/upload-pages-artifact", "v3")