diff --git a/.github/workflows/reviewer-ci.yml b/.github/workflows/reviewer-ci.yml
index 391fb9b50..d3f37e7ed 100644
--- a/.github/workflows/reviewer-ci.yml
+++ b/.github/workflows/reviewer-ci.yml
@@ -25,7 +25,7 @@ jobs:
         working-directory: reviewer
     steps:
       - name: checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
@@ -43,7 +43,7 @@ jobs:
           test "$(git rev-parse HEAD)" = "$NOEMA_EXPECTED_HEAD_SHA"
 
       - name: setup python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
 
diff --git a/test/reviewer-ci-action-runtime-integrity.test.ts b/test/reviewer-ci-action-runtime-integrity.test.ts
new file mode 100644
index 000000000..740cadf50
--- /dev/null
+++ b/test/reviewer-ci-action-runtime-integrity.test.ts
@@ -0,0 +1,21 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+const workflow = readFileSync(".github/workflows/reviewer-ci.yml", "utf8");
+
+describe("reviewer CI action runtime integrity", () => {
+  it("uses immutable Node 24-native GitHub actions", () => {
+    expect(workflow).toContain(
+      "uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1",
+    );
+    expect(workflow).toContain(
+      "uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0",
+    );
+    expect(workflow).not.toContain(
+      "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683",
+    );
+    expect(workflow).not.toContain(
+      "actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065",
+    );
+  });
+});