diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0904406f4..e4749f1f7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/setup@v1
+      - uses: pnpm/setup@v2
         with:
           cache: true
           install: false
@@ -38,7 +38,7 @@ jobs:
         node-version: ['22.19.0', '24', '26']
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/setup@v1
+      - uses: pnpm/setup@v2
         with:
           cache: true
           install: false
@@ -59,7 +59,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/setup@v1
+      - uses: pnpm/setup@v2
         with:
           cache: true
           install: false
@@ -77,7 +77,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/setup@v1
+      - uses: pnpm/setup@v2
         with:
           cache: true
           install: false
diff --git a/.github/workflows/native-host-smoke.yml b/.github/workflows/native-host-smoke.yml
index 4ce8cd54b..9e5223c18 100644
--- a/.github/workflows/native-host-smoke.yml
+++ b/.github/workflows/native-host-smoke.yml
@@ -34,7 +34,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         if: inputs.host == 'both' || inputs.host == matrix.host
-      - uses: pnpm/setup@v1
+      - uses: pnpm/setup@v2
         if: inputs.host == 'both' || inputs.host == matrix.host
         with:
           cache: true
diff --git a/.github/workflows/package-preview.yml b/.github/workflows/package-preview.yml
index c3897cf85..f066f61e0 100644
--- a/.github/workflows/package-preview.yml
+++ b/.github/workflows/package-preview.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/setup@v1
+      - uses: pnpm/setup@v2
         with:
           cache: true
           install: false
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index baa23eba5..6aa5f650f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ jobs:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: echo "enabled=${{ env.NPM_TOKEN != '' }}" >> "$GITHUB_OUTPUT"
       - if: steps.gate.outputs.enabled == 'true'
-        uses: pnpm/setup@v1
+        uses: pnpm/setup@v2
         with:
           cache: true
           install: false
diff --git a/packages/agent-bundle/tests/native-host-smoke-workflow.test.ts b/packages/agent-bundle/tests/native-host-smoke-workflow.test.ts
index b254864c8..17593f26a 100644
--- a/packages/agent-bundle/tests/native-host-smoke-workflow.test.ts
+++ b/packages/agent-bundle/tests/native-host-smoke-workflow.test.ts
@@ -58,5 +58,5 @@ it('keeps source and installed-tarball native smokes in the manual self-hosted m
   expect(launcher).toContain("spawn(npm, args, { env: environment, stdio: 'inherit' })");
   expect(launcher).not.toMatch(/(?:^|\s)AGENT_BUNDLE_PACKED_NATIVE_[A-Z_]+=1\s+npm/u);
   expect(workflow).not.toMatch(/\bcorepack\b/u);
-  expect(workflow).toContain('uses: pnpm/setup@v1');
+  expect(workflow).toContain('uses: pnpm/setup@v2');
 });
diff --git a/packages/agent-bundle/tests/package-lint-workflow.test.ts b/packages/agent-bundle/tests/package-lint-workflow.test.ts
index 8d6075059..78062290b 100644
--- a/packages/agent-bundle/tests/package-lint-workflow.test.ts
+++ b/packages/agent-bundle/tests/package-lint-workflow.test.ts
@@ -30,7 +30,7 @@ it('runs publint explicitly in CI and the local release audit', async () => {
   const steps = parsed.jobs?.verify?.steps ?? [];
   const rscSteps = parsed.jobs?.['rsc-runtime-micro-eval']?.steps ?? [];
   const packageLintIndex = steps.findIndex((step) => step.run === 'pnpm lint:package');
-  const setup = steps.find((step) => step.uses === 'pnpm/setup@v1');
+  const setup = steps.find((step) => step.uses === 'pnpm/setup@v2');
 
   expect(packageJson.scripts?.['lint:package']).toBe('publint packages/agent-bundle');
   expect(packageJson.scripts?.['audit:release']).toMatch(/^pnpm lint:package && /u);
@@ -40,7 +40,7 @@ it('runs publint explicitly in CI and the local release audit', async () => {
   expect(steps[packageLintIndex - 1]?.run).toBe('pnpm build');
   expect(rscSteps.map((step) => step.uses ?? step.run)).toEqual([
     'actions/checkout@v7',
-    'pnpm/setup@v1',
+    'pnpm/setup@v2',
     'pnpm install --frozen-lockfile',
     'pnpm eval:spot',
   ]);
diff --git a/packages/agent-bundle/tests/package-preview-workflow.test.ts b/packages/agent-bundle/tests/package-preview-workflow.test.ts
index a71861a64..00de1e461 100644
--- a/packages/agent-bundle/tests/package-preview-workflow.test.ts
+++ b/packages/agent-bundle/tests/package-preview-workflow.test.ts
@@ -37,7 +37,7 @@ it('publishes one locked package preview for pull requests', async () => {
   expect(parsed.permissions).toEqual({});
   expect(steps.map((step) => step.uses ?? step.run)).toEqual([
     'actions/checkout@v7',
-    'pnpm/setup@v1',
+    'pnpm/setup@v2',
     'pnpm install --frozen-lockfile',
     'pnpm build',
     'pnpm preview:publish',