From eb9d2f9a06bcf1310904e04fec39e85bc9d51b71 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Wed, 21 Oct 2026 17:06:28 -0700
Subject: [PATCH] fix(security): update Node runtimes for October security
 releases (#31687)

* fix(security): update Node runtimes for October security releases

* fix(ci): compare normalized web file inventory without ordering artifacts
---
 .../install-node-dependencies/action.yml      |  2 +
 .../actions/setup-wsl-test-runtime/setup.ps1  |  4 +-
 .github/workflows/adhoc-mac-build.yml         |  2 +
 .github/workflows/ci-xterm-cache.yml          |  1 +
 ...cloud-bootstrap-relay-staging-capacity.yml |  1 +
 ...d-deploy-relay-production-capacity-job.yml |  1 +
 ...cloud-deploy-relay-production-capacity.yml |  1 +
 ...cloud-deploy-relay-production-director.yml |  1 +
 ...d-deploy-relay-production-multi-target.yml |  1 +
 ...d-deploy-relay-production-same-cap-job.yml |  1 +
 ...cloud-deploy-relay-production-same-cap.yml |  4 +-
 .../cloud-deploy-relay-production.yml         |  1 +
 ...oud-deploy-relay-staging-gce-candidate.yml |  1 +
 .../workflows/cloud-deploy-relay-staging.yml  |  1 +
 .../cloud-monitor-relay-production-job.yml    |  1 +
 .../cloud-operate-relay-asia-admission.yml    |  1 +
 ...ud-operate-relay-production-cell-flags.yml |  1 +
 ...ud-operate-relay-production-rehome-job.yml |  1 +
 ...operate-relay-production-reserve-watch.yml |  2 +
 ...cloud-operate-relay-staging-cell-flags.yml |  1 +
 .../workflows/cloud-power-relay-staging.yml   |  1 +
 .../cloud-prove-relay-asia-staging.yml        |  3 +
 .../cloud-prove-relay-staging-capacity.yml    |  2 +
 .../cloud-recover-relay-staging-c4-image.yml  |  1 +
 .github/workflows/cloud-verify.yml            |  2 +
 .github/workflows/daemon-relocation-spike.yml |  1 +
 .github/workflows/daily-mac-build.yml         |  1 +
 .github/workflows/dev-channel-win-build.yml   |  1 +
 .github/workflows/docs.yml                    |  2 +
 .github/workflows/golden-e2e-experiment.yml   |  1 +
 .github/workflows/hourly-mac-build.yml        |  1 +
 .../workflows/linux-wayland-gpu-sandbox.yml   |  1 +
 .github/workflows/mobile-android-release.yml  |  1 +
 .github/workflows/mobile-ios-release.yml      |  1 +
 .github/workflows/node-server-tests.yml       |  3 +-
 .github/workflows/pr.yml                      |  2 +
 .../workflows/qualified-orcad-template.yml    |  1 +
 .github/workflows/release-cut.yml             |  7 ++
 .../release-javascript-benchmark.yml          |  1 +
 .github/workflows/release-mac-build.yml       |  1 +
 .github/workflows/skill-update-roundtrip.yml  |  1 +
 .github/workflows/ssh-hostile-hosts.yml       |  2 +-
 .github/workflows/terminal-perf.yml           |  1 +
 .../workflows/unit-module-cache-benchmark.yml |  6 +-
 .github/workflows/win-crash-survival-e2e.yml  |  1 +
 .github/workflows/win-update-e2e.yml          |  1 +
 .github/workflows/win-update-survival-e2e.yml |  1 +
 .../windows-native-preparation-benchmark.yml  |  2 +-
 .../workflows/windows-signing-rehearsal.yml   |  1 +
 .../windows-terminal-restart-e2e.yml          |  1 +
 cloud/.node-version                           |  2 +-
 cloud/apps/push/Dockerfile                    |  4 +-
 cloud/apps/relay-fence-broker/Dockerfile      |  2 +-
 cloud/apps/relay/Dockerfile                   |  4 +-
 .../docker/daemon-scope-lifetime/Dockerfile   |  2 +-
 .../daemon-shutdown-descendants/Dockerfile    |  2 +-
 .../docker/headless-pairing/Dockerfile.build  |  2 +-
 .../linux-lid-sleep-assertion/Dockerfile      |  2 +-
 .../benchmark-windows-native-preparation.mjs  |  2 +-
 config/scripts/ci-unit-module-cache.test.mjs  |  2 +-
 config/scripts/release-javascript-parity.mjs  |  6 ++
 .../release-javascript-parity.test.mjs        | 24 ++++++
 ...dows-native-preparation-benchmark.test.mjs |  2 +-
 .../windows-security-reuse-benchmark.test.mjs |  3 +-
 .../orcad-remote-node-runtime-windows.test.ts | 10 +--
 src/shared/node-runtime-pin.ts                | 78 +++++++++----------
 tests/e2e/fixtures/docker-ssh-host/Dockerfile |  3 +
 67 files changed, 162 insertions(+), 68 deletions(-)

diff --git a/.github/actions/install-node-dependencies/action.yml b/.github/actions/install-node-dependencies/action.yml
index 1332106a4db..d37c15249b7 100644
--- a/.github/actions/install-node-dependencies/action.yml
+++ b/.github/actions/install-node-dependencies/action.yml
@@ -104,6 +104,7 @@ runs:
       uses: actions/setup-node@v6
       with:
         node-version-file: package.json
+        check-latest: true
         cache: ${{ github.event_name != 'pull_request' && inputs.cache-pnpm-store != 'false' && steps.pnpm-store-mode.outputs.lookup-only != 'true' && 'pnpm' || '' }}
         cache-dependency-path: ${{ inputs.cache-dependency-path }}
         package-manager-cache: false
@@ -114,6 +115,7 @@ runs:
       uses: actions/setup-node@v6
       with:
         node-version: ${{ inputs.node-version }}
+        check-latest: true
         cache: ${{ github.event_name != 'pull_request' && inputs.cache-pnpm-store != 'false' && steps.pnpm-store-mode.outputs.lookup-only != 'true' && 'pnpm' || '' }}
         cache-dependency-path: ${{ inputs.cache-dependency-path }}
         package-manager-cache: false
diff --git a/.github/actions/setup-wsl-test-runtime/setup.ps1 b/.github/actions/setup-wsl-test-runtime/setup.ps1
index 2fd012eb246..9547aaa74bd 100644
--- a/.github/actions/setup-wsl-test-runtime/setup.ps1
+++ b/.github/actions/setup-wsl-test-runtime/setup.ps1
@@ -20,10 +20,10 @@ $installer = Start-Process msiexec.exe -ArgumentList @('/i', $kernelMsi, '/quiet
 if ($installer.ExitCode -ne 0) { throw "WSL kernel installation failed: $($installer.ExitCode)" }
 wsl.exe --status
 if ($LASTEXITCODE -ne 0) { throw "WSL status failed: $LASTEXITCODE" }
-wsl.exe --distribution Ubuntu --user root --exec /usr/bin/curl --fail --silent --show-error --location https://nodejs.org/dist/v22.14.0/node-v22.14.0-linux-x64.tar.xz --output /tmp/orca-node.tar.xz
+wsl.exe --distribution Ubuntu --user root --exec /usr/bin/curl --fail --silent --show-error --location https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-x64.tar.xz --output /tmp/orca-node.tar.xz
 if ($LASTEXITCODE -ne 0) { throw 'Node download failed' }
 $nodeHash = wsl.exe --distribution Ubuntu --user root --exec /usr/bin/sha256sum /tmp/orca-node.tar.xz
-if ($LASTEXITCODE -ne 0 -or -not ($nodeHash -match '^69b09dba5c8dcb05c4e4273a4340db1005abeafe3927efda2bc5b249e80437ec')) { throw 'Node checksum mismatch' }
+if ($LASTEXITCODE -ne 0 -or -not ($nodeHash -match '^1805bcd35e6815559bd2eb97db438d3fdb0eb3a5e6a977b7c1badca76337e9ce')) { throw 'Node checksum mismatch' }
 wsl.exe --distribution Ubuntu --user root --exec /usr/bin/tar -xJf /tmp/orca-node.tar.xz -C /usr/local --strip-components=1
 if ($LASTEXITCODE -ne 0) { throw 'Node extraction failed' }
 wsl.exe --distribution Ubuntu --user root --exec /usr/local/bin/node --version
diff --git a/.github/workflows/adhoc-mac-build.yml b/.github/workflows/adhoc-mac-build.yml
index 940e47b47e7..0b84153b90f 100644
--- a/.github/workflows/adhoc-mac-build.yml
+++ b/.github/workflows/adhoc-mac-build.yml
@@ -175,6 +175,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           package-manager-cache: false
 
       - name: Compute adhoc version
@@ -415,6 +416,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           cache: pnpm
           cache-dependency-path: |
             pnpm-lock.yaml
diff --git a/.github/workflows/ci-xterm-cache.yml b/.github/workflows/ci-xterm-cache.yml
index fada7ea8cab..4527648a0c5 100644
--- a/.github/workflows/ci-xterm-cache.yml
+++ b/.github/workflows/ci-xterm-cache.yml
@@ -32,6 +32,7 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           package-manager-cache: false
       - uses: ./.github/actions/prepare-xterm-dependencies
         id: cache
diff --git a/.github/workflows/cloud-bootstrap-relay-staging-capacity.yml b/.github/workflows/cloud-bootstrap-relay-staging-capacity.yml
index ff81e759668..38e0efb9acc 100644
--- a/.github/workflows/cloud-bootstrap-relay-staging-capacity.yml
+++ b/.github/workflows/cloud-bootstrap-relay-staging-capacity.yml
@@ -66,6 +66,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - name: Require explicit bootstrap confirmation
         env:
diff --git a/.github/workflows/cloud-deploy-relay-production-capacity-job.yml b/.github/workflows/cloud-deploy-relay-production-capacity-job.yml
index cd41c5281bc..0c791ca1071 100644
--- a/.github/workflows/cloud-deploy-relay-production-capacity-job.yml
+++ b/.github/workflows/cloud-deploy-relay-production-capacity-job.yml
@@ -168,6 +168,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - run: pnpm install --frozen-lockfile
 
diff --git a/.github/workflows/cloud-deploy-relay-production-capacity.yml b/.github/workflows/cloud-deploy-relay-production-capacity.yml
index 7f75b7e8d3e..caeb288dbb8 100644
--- a/.github/workflows/cloud-deploy-relay-production-capacity.yml
+++ b/.github/workflows/cloud-deploy-relay-production-capacity.yml
@@ -137,6 +137,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - run: pnpm install --frozen-lockfile
 
diff --git a/.github/workflows/cloud-deploy-relay-production-director.yml b/.github/workflows/cloud-deploy-relay-production-director.yml
index 619b78710e4..6ec0029b450 100644
--- a/.github/workflows/cloud-deploy-relay-production-director.yml
+++ b/.github/workflows/cloud-deploy-relay-production-director.yml
@@ -122,6 +122,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - name: Resolve immutable production image
         shell: bash
diff --git a/.github/workflows/cloud-deploy-relay-production-multi-target.yml b/.github/workflows/cloud-deploy-relay-production-multi-target.yml
index d780c402a96..946322745d8 100644
--- a/.github/workflows/cloud-deploy-relay-production-multi-target.yml
+++ b/.github/workflows/cloud-deploy-relay-production-multi-target.yml
@@ -194,6 +194,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - run: pnpm install --frozen-lockfile
 
diff --git a/.github/workflows/cloud-deploy-relay-production-same-cap-job.yml b/.github/workflows/cloud-deploy-relay-production-same-cap-job.yml
index c0ae3451dc7..2be3f07c09a 100644
--- a/.github/workflows/cloud-deploy-relay-production-same-cap-job.yml
+++ b/.github/workflows/cloud-deploy-relay-production-same-cap-job.yml
@@ -97,6 +97,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - run: pnpm install --frozen-lockfile
 
diff --git a/.github/workflows/cloud-deploy-relay-production-same-cap.yml b/.github/workflows/cloud-deploy-relay-production-same-cap.yml
index 859fcd90751..82a84648c22 100644
--- a/.github/workflows/cloud-deploy-relay-production-same-cap.yml
+++ b/.github/workflows/cloud-deploy-relay-production-same-cap.yml
@@ -99,7 +99,7 @@ jobs:
           fetch-depth: 0
 
       - uses: actions/setup-node@v4
-        with: { node-version: 24 }
+        with: { node-version: 24, check-latest: true }
 
       - id: wave
         env:
@@ -361,7 +361,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - uses: actions/setup-node@v4
-        with: { node-version: 24 }
+        with: { node-version: 24, check-latest: true }
 
       # Its pace checks are what let a batch drain faster than the default; a missing artifact
       # seals UNVERIFIED, which only the default accepts. Named from the gate's normalized cell,
diff --git a/.github/workflows/cloud-deploy-relay-production.yml b/.github/workflows/cloud-deploy-relay-production.yml
index 9aa7af1f559..61f0f6a3e4a 100644
--- a/.github/workflows/cloud-deploy-relay-production.yml
+++ b/.github/workflows/cloud-deploy-relay-production.yml
@@ -91,6 +91,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - run: pnpm install --frozen-lockfile
 
diff --git a/.github/workflows/cloud-deploy-relay-staging-gce-candidate.yml b/.github/workflows/cloud-deploy-relay-staging-gce-candidate.yml
index ec4426ccc44..832fb3bc03f 100644
--- a/.github/workflows/cloud-deploy-relay-staging-gce-candidate.yml
+++ b/.github/workflows/cloud-deploy-relay-staging-gce-candidate.yml
@@ -77,6 +77,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - name: Require explicit mutation confirmation
         if: ${{ inputs.mode != 'preflight' }}
diff --git a/.github/workflows/cloud-deploy-relay-staging.yml b/.github/workflows/cloud-deploy-relay-staging.yml
index 29e9eda288c..17c684627e6 100644
--- a/.github/workflows/cloud-deploy-relay-staging.yml
+++ b/.github/workflows/cloud-deploy-relay-staging.yml
@@ -167,6 +167,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - name: Require the mirrored immutable image
         run: |
diff --git a/.github/workflows/cloud-monitor-relay-production-job.yml b/.github/workflows/cloud-monitor-relay-production-job.yml
index 1c10b905934..324ae88edfc 100644
--- a/.github/workflows/cloud-monitor-relay-production-job.yml
+++ b/.github/workflows/cloud-monitor-relay-production-job.yml
@@ -65,6 +65,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - run: pnpm install --frozen-lockfile
 
diff --git a/.github/workflows/cloud-operate-relay-asia-admission.yml b/.github/workflows/cloud-operate-relay-asia-admission.yml
index 79752e43db6..16671472855 100644
--- a/.github/workflows/cloud-operate-relay-asia-admission.yml
+++ b/.github/workflows/cloud-operate-relay-asia-admission.yml
@@ -193,6 +193,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - uses: pnpm/setup@v2
         with:
diff --git a/.github/workflows/cloud-operate-relay-production-cell-flags.yml b/.github/workflows/cloud-operate-relay-production-cell-flags.yml
index d3e0e2d9fd4..148ebb7fd48 100644
--- a/.github/workflows/cloud-operate-relay-production-cell-flags.yml
+++ b/.github/workflows/cloud-operate-relay-production-cell-flags.yml
@@ -82,6 +82,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - id: google-auth
         uses: google-github-actions/auth@v2
diff --git a/.github/workflows/cloud-operate-relay-production-rehome-job.yml b/.github/workflows/cloud-operate-relay-production-rehome-job.yml
index cbc3efd38d0..82b62872ed3 100644
--- a/.github/workflows/cloud-operate-relay-production-rehome-job.yml
+++ b/.github/workflows/cloud-operate-relay-production-rehome-job.yml
@@ -106,6 +106,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - id: google-auth
         uses: google-github-actions/auth@v2
diff --git a/.github/workflows/cloud-operate-relay-production-reserve-watch.yml b/.github/workflows/cloud-operate-relay-production-reserve-watch.yml
index 2711cd06210..78e24a1d567 100644
--- a/.github/workflows/cloud-operate-relay-production-reserve-watch.yml
+++ b/.github/workflows/cloud-operate-relay-production-reserve-watch.yml
@@ -114,6 +114,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - id: google-auth-1
         uses: google-github-actions/auth@v2
@@ -276,6 +277,7 @@ jobs:
         if: ${{ always() }}
         with:
           node-version: 24
+          check-latest: true
 
       - id: google-auth
         if: ${{ always() }}
diff --git a/.github/workflows/cloud-operate-relay-staging-cell-flags.yml b/.github/workflows/cloud-operate-relay-staging-cell-flags.yml
index 501d00faebc..6e2f747f0b1 100644
--- a/.github/workflows/cloud-operate-relay-staging-cell-flags.yml
+++ b/.github/workflows/cloud-operate-relay-staging-cell-flags.yml
@@ -84,6 +84,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - id: google-auth
         uses: google-github-actions/auth@v2
diff --git a/.github/workflows/cloud-power-relay-staging.yml b/.github/workflows/cloud-power-relay-staging.yml
index 2365121a60f..90134d01ffa 100644
--- a/.github/workflows/cloud-power-relay-staging.yml
+++ b/.github/workflows/cloud-power-relay-staging.yml
@@ -76,6 +76,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - name: Require explicit manual mutation confirmation
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.mode != 'status' }}
diff --git a/.github/workflows/cloud-prove-relay-asia-staging.yml b/.github/workflows/cloud-prove-relay-asia-staging.yml
index e214a8a330d..cded70218ca 100644
--- a/.github/workflows/cloud-prove-relay-asia-staging.yml
+++ b/.github/workflows/cloud-prove-relay-asia-staging.yml
@@ -123,6 +123,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - uses: pnpm/setup@v2
         with:
@@ -346,6 +347,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - name: Recover staging C4 with a fresh identity
         env:
@@ -433,6 +435,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - uses: pnpm/setup@v2
         with:
diff --git a/.github/workflows/cloud-prove-relay-staging-capacity.yml b/.github/workflows/cloud-prove-relay-staging-capacity.yml
index d841c3f397d..37aa555c5c1 100644
--- a/.github/workflows/cloud-prove-relay-staging-capacity.yml
+++ b/.github/workflows/cloud-prove-relay-staging-capacity.yml
@@ -107,6 +107,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - name: Initialize the exact staging backend
         if: ${{ inputs.mode != 'restore-admission' }}
@@ -655,6 +656,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - name: Initialize the exact staging backend
         run: node dev/scripts/infra.mjs init --env staging
diff --git a/.github/workflows/cloud-recover-relay-staging-c4-image.yml b/.github/workflows/cloud-recover-relay-staging-c4-image.yml
index 396313e3307..a83e656bb68 100644
--- a/.github/workflows/cloud-recover-relay-staging-c4-image.yml
+++ b/.github/workflows/cloud-recover-relay-staging-c4-image.yml
@@ -102,6 +102,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - name: Initialize the exact staging backend
         run: node dev/scripts/infra.mjs init --env staging
diff --git a/.github/workflows/cloud-verify.yml b/.github/workflows/cloud-verify.yml
index 4d0f74949a2..71b0d5c4883 100644
--- a/.github/workflows/cloud-verify.yml
+++ b/.github/workflows/cloud-verify.yml
@@ -94,6 +94,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
@@ -134,6 +135,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          check-latest: true
 
       - run: pnpm install --frozen-lockfile
       - run: pnpm test
diff --git a/.github/workflows/daemon-relocation-spike.yml b/.github/workflows/daemon-relocation-spike.yml
index 584986086b9..25a88ae949f 100644
--- a/.github/workflows/daemon-relocation-spike.yml
+++ b/.github/workflows/daemon-relocation-spike.yml
@@ -41,6 +41,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
 
       - name: Setup pnpm
         uses: pnpm/setup@v2
diff --git a/.github/workflows/daily-mac-build.yml b/.github/workflows/daily-mac-build.yml
index c7e15044146..010c610892b 100644
--- a/.github/workflows/daily-mac-build.yml
+++ b/.github/workflows/daily-mac-build.yml
@@ -188,6 +188,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           cache: pnpm
           cache-dependency-path: |
             pnpm-lock.yaml
diff --git a/.github/workflows/dev-channel-win-build.yml b/.github/workflows/dev-channel-win-build.yml
index 003cd3b629e..a94f80b1de1 100644
--- a/.github/workflows/dev-channel-win-build.yml
+++ b/.github/workflows/dev-channel-win-build.yml
@@ -236,6 +236,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           cache: pnpm
           cache-dependency-path: |
             pnpm-lock.yaml
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index dd78c63edd4..734dda24c09 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -56,6 +56,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: docs/site/package.json
+          check-latest: true
           # setup-node probes the store from the repository root, not this app.
           package-manager-cache: false
 
@@ -228,6 +229,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: docs/site/package.json
+          check-latest: true
           package-manager-cache: false
 
       - name: Install site dependencies
diff --git a/.github/workflows/golden-e2e-experiment.yml b/.github/workflows/golden-e2e-experiment.yml
index 0b80662d716..507c554e298 100644
--- a/.github/workflows/golden-e2e-experiment.yml
+++ b/.github/workflows/golden-e2e-experiment.yml
@@ -41,6 +41,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
 
       - name: Setup pnpm
         uses: pnpm/setup@v2
diff --git a/.github/workflows/hourly-mac-build.yml b/.github/workflows/hourly-mac-build.yml
index 062ef68169a..48e405c2f86 100644
--- a/.github/workflows/hourly-mac-build.yml
+++ b/.github/workflows/hourly-mac-build.yml
@@ -177,6 +177,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           cache: pnpm
           cache-dependency-path: |
             pnpm-lock.yaml
diff --git a/.github/workflows/linux-wayland-gpu-sandbox.yml b/.github/workflows/linux-wayland-gpu-sandbox.yml
index 15af59da8a5..9743afef452 100644
--- a/.github/workflows/linux-wayland-gpu-sandbox.yml
+++ b/.github/workflows/linux-wayland-gpu-sandbox.yml
@@ -22,6 +22,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
 
       - name: Setup pnpm
         uses: pnpm/setup@v2
diff --git a/.github/workflows/mobile-android-release.yml b/.github/workflows/mobile-android-release.yml
index 7ca80a664da..a9e269c0b75 100644
--- a/.github/workflows/mobile-android-release.yml
+++ b/.github/workflows/mobile-android-release.yml
@@ -46,6 +46,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version: 24
+          check-latest: true
 
       - name: Setup pnpm
         uses: pnpm/setup@v2
diff --git a/.github/workflows/mobile-ios-release.yml b/.github/workflows/mobile-ios-release.yml
index f149b6aa615..4c637183f0e 100644
--- a/.github/workflows/mobile-ios-release.yml
+++ b/.github/workflows/mobile-ios-release.yml
@@ -62,6 +62,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version: 24
+          check-latest: true
 
       - name: Setup pnpm
         uses: pnpm/setup@v2
diff --git a/.github/workflows/node-server-tests.yml b/.github/workflows/node-server-tests.yml
index 17537203820..979489a5de4 100644
--- a/.github/workflows/node-server-tests.yml
+++ b/.github/workflows/node-server-tests.yml
@@ -78,6 +78,7 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           package-manager-cache: false
       - name: Detect headless-server build and test inputs
         id: scope
@@ -526,7 +527,7 @@ jobs:
             -e ORCA_BACKGROUND_LAUNCH=1 \
             -v "$VERIFICATION_CACHE_PATH:/root/.cache/pnpm/lockfile-verified.jsonl" \
             -v "$GITHUB_WORKSPACE:/work" -w /work \
-            node:24.21.0-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 sleep infinity
+            node:24.22.1-alpine@sha256:6a1c190e17215d844926b0677f4bf87273ff7d5e54db06d3b5b5863ab0b09a3d sleep infinity
           docker exec -i orcad-alpine sh -s <<'NODE_SERVER_PREPARATION'
           set -eu
           apk add --no-cache bash git libstdc++ python3 make g++
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 23fb0ffd21c..b087d471b29 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -755,6 +755,7 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           package-manager-cache: false
 
       # Rebuild both pristine and patched bundles; reuse only the pinned toolchain.
@@ -1529,6 +1530,7 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           package-manager-cache: false
 
       - name: Setup pnpm
diff --git a/.github/workflows/qualified-orcad-template.yml b/.github/workflows/qualified-orcad-template.yml
index b70a5653f16..d0ef6545b98 100644
--- a/.github/workflows/qualified-orcad-template.yml
+++ b/.github/workflows/qualified-orcad-template.yml
@@ -32,6 +32,7 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           package-manager-cache: false
       - name: Checkout the workflow policy
         uses: actions/checkout@v6
diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml
index 386bdb1b7db..ff462cc0e70 100644
--- a/.github/workflows/release-cut.yml
+++ b/.github/workflows/release-cut.yml
@@ -128,6 +128,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
 
       - name: Configure git author
         run: |
@@ -902,6 +903,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           cache: pnpm
 
       # Why: Linux terminal golden E2E uses the same native install path as
@@ -1128,6 +1130,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           cache: pnpm
 
       # Why: keep the non-blocking evidence lane on the same Linux native
@@ -1351,6 +1354,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           cache: pnpm
           cache-dependency-path: |
             pnpm-lock.yaml
@@ -2377,6 +2381,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
 
       - name: Run isolated macOS release build
         id: dispatch
@@ -2413,6 +2418,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
 
       - name: Require the exact isolated macOS release build to succeed
         run: node config/scripts/run-release-mac-build-workflow.mjs wait
@@ -2457,6 +2463,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
 
       - name: Verify release is still draft
         env:
diff --git a/.github/workflows/release-javascript-benchmark.yml b/.github/workflows/release-javascript-benchmark.yml
index 40f7edcb8ad..b82ba4046d1 100644
--- a/.github/workflows/release-javascript-benchmark.yml
+++ b/.github/workflows/release-javascript-benchmark.yml
@@ -102,6 +102,7 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
       - uses: ./.github/actions/install-node-dependencies
       - uses: actions/download-artifact@v8
         with:
diff --git a/.github/workflows/release-mac-build.yml b/.github/workflows/release-mac-build.yml
index 8f904b1fcdb..f709e42d22a 100644
--- a/.github/workflows/release-mac-build.yml
+++ b/.github/workflows/release-mac-build.yml
@@ -91,6 +91,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           cache: pnpm
           cache-dependency-path: |
             pnpm-lock.yaml
diff --git a/.github/workflows/skill-update-roundtrip.yml b/.github/workflows/skill-update-roundtrip.yml
index 6a1e58ca798..f0d53b71d6e 100644
--- a/.github/workflows/skill-update-roundtrip.yml
+++ b/.github/workflows/skill-update-roundtrip.yml
@@ -50,6 +50,7 @@ jobs:
         id: node
         with:
           node-version-file: package.json
+          check-latest: true
       - name: Verify pinned symlink placement with autocrlf false
         if: ${{ !cancelled() && matrix.skills-cli == 'pinned' && steps.checkout.outcome == 'success' && steps.node.outcome == 'success' }}
         env:
diff --git a/.github/workflows/ssh-hostile-hosts.yml b/.github/workflows/ssh-hostile-hosts.yml
index d1a3a15eee6..10905dd86ab 100644
--- a/.github/workflows/ssh-hostile-hosts.yml
+++ b/.github/workflows/ssh-hostile-hosts.yml
@@ -116,7 +116,7 @@ jobs:
             -e ORCA_BACKGROUND_LAUNCH=1 \
             -v "$VERIFICATION_CACHE_PATH:/root/.cache/pnpm/lockfile-verified.jsonl" \
             -v "$GITHUB_WORKSPACE:/work" -w /work \
-            node:24.21.0-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 sh -s <<'MUSL_SLOT'
+            node:24.22.1-alpine@sha256:6a1c190e17215d844926b0677f4bf87273ff7d5e54db06d3b5b5863ab0b09a3d sh -s <<'MUSL_SLOT'
           set -eu
           apk add --no-cache bash git libstdc++ python3 make g++
           git config --global --add safe.directory /work
diff --git a/.github/workflows/terminal-perf.yml b/.github/workflows/terminal-perf.yml
index c95854d49ee..a0e10e0eb90 100644
--- a/.github/workflows/terminal-perf.yml
+++ b/.github/workflows/terminal-perf.yml
@@ -115,6 +115,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           cache: pnpm
 
       # Historical refs can lack the shared action; retain their original install path.
diff --git a/.github/workflows/unit-module-cache-benchmark.yml b/.github/workflows/unit-module-cache-benchmark.yml
index d15f262d235..58f3e3d4040 100644
--- a/.github/workflows/unit-module-cache-benchmark.yml
+++ b/.github/workflows/unit-module-cache-benchmark.yml
@@ -14,7 +14,7 @@ jobs:
   baseline:
     uses: ./.github/workflows/unit-tests.yml
     with:
-      node_versions: '["24.21.0"]'
+      node_versions: '["24.22.1"]'
       runner: ubuntu-24.04-arm
       shards: '[{"index":1,"count":5},{"index":2,"count":5},{"index":3,"count":5},{"index":4,"count":5},{"index":5,"count":5}]'
       artifact_prefix: baseline-unit
@@ -25,7 +25,7 @@ jobs:
     needs: baseline
     uses: ./.github/workflows/unit-tests.yml
     with:
-      node_versions: '["24.21.0"]'
+      node_versions: '["24.22.1"]'
       runner: ubuntu-24.04-arm
       shards: '[{"index":1,"count":5},{"index":2,"count":5},{"index":3,"count":5},{"index":4,"count":5},{"index":5,"count":5}]'
       artifact_prefix: producer-unit
@@ -39,7 +39,7 @@ jobs:
     needs: producer
     uses: ./.github/workflows/unit-tests.yml
     with:
-      node_versions: '["24.21.0"]'
+      node_versions: '["24.22.1"]'
       runner: ubuntu-24.04-arm
       shards: '[{"index":1,"count":5},{"index":2,"count":5},{"index":3,"count":5},{"index":4,"count":5},{"index":5,"count":5}]'
       artifact_prefix: warm-unit
diff --git a/.github/workflows/win-crash-survival-e2e.yml b/.github/workflows/win-crash-survival-e2e.yml
index 81c3e726faf..eabb84bb955 100644
--- a/.github/workflows/win-crash-survival-e2e.yml
+++ b/.github/workflows/win-crash-survival-e2e.yml
@@ -55,6 +55,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           cache: pnpm
           cache-dependency-path: |
             pnpm-lock.yaml
diff --git a/.github/workflows/win-update-e2e.yml b/.github/workflows/win-update-e2e.yml
index 2a1bde70924..48738213729 100644
--- a/.github/workflows/win-update-e2e.yml
+++ b/.github/workflows/win-update-e2e.yml
@@ -83,6 +83,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
 
       - name: Setup pnpm
         uses: pnpm/setup@v2
diff --git a/.github/workflows/win-update-survival-e2e.yml b/.github/workflows/win-update-survival-e2e.yml
index 9b0884f91b0..a52959327de 100644
--- a/.github/workflows/win-update-survival-e2e.yml
+++ b/.github/workflows/win-update-survival-e2e.yml
@@ -71,6 +71,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
 
       - name: Setup pnpm
         uses: pnpm/setup@v2
diff --git a/.github/workflows/windows-native-preparation-benchmark.yml b/.github/workflows/windows-native-preparation-benchmark.yml
index 845628d7f7a..709c1dbd4f6 100644
--- a/.github/workflows/windows-native-preparation-benchmark.yml
+++ b/.github/workflows/windows-native-preparation-benchmark.yml
@@ -49,7 +49,7 @@ jobs:
           node -e 'require("node:fs").writeFileSync(".build/windows-native-benchmark/job-start.json", JSON.stringify({startedAt:new Date().toISOString()}))'
       - uses: ./.github/actions/install-node-dependencies
         with:
-          node-version: '24.21.0'
+          node-version: '24.22.1'
           native-runtime: none
           cache-pnpm-store: 'false'
           cache-pnpm-verification: 'false'
diff --git a/.github/workflows/windows-signing-rehearsal.yml b/.github/workflows/windows-signing-rehearsal.yml
index 5aee75ca50a..ceadbe3d14f 100644
--- a/.github/workflows/windows-signing-rehearsal.yml
+++ b/.github/workflows/windows-signing-rehearsal.yml
@@ -56,6 +56,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           cache: pnpm
           cache-dependency-path: |
             pnpm-lock.yaml
diff --git a/.github/workflows/windows-terminal-restart-e2e.yml b/.github/workflows/windows-terminal-restart-e2e.yml
index d576ee65049..aca145111e3 100644
--- a/.github/workflows/windows-terminal-restart-e2e.yml
+++ b/.github/workflows/windows-terminal-restart-e2e.yml
@@ -41,6 +41,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          check-latest: true
           cache: pnpm
 
       - name: Install dependencies
diff --git a/cloud/.node-version b/cloud/.node-version
index 14db15d775c..07fcedb931e 100644
--- a/cloud/.node-version
+++ b/cloud/.node-version
@@ -1,2 +1,2 @@
-24
+24.22.1
 
diff --git a/cloud/apps/push/Dockerfile b/cloud/apps/push/Dockerfile
index efdc85fc404..2d9f49076d5 100644
--- a/cloud/apps/push/Dockerfile
+++ b/cloud/apps/push/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:24-alpine AS build
+FROM node:24.22.1-alpine AS build
 WORKDIR /app
 RUN corepack enable
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./
@@ -11,7 +11,7 @@ COPY apps/push apps/push
 COPY packages/postgres-schema packages/postgres-schema
 RUN pnpm --filter @orca-cloud/postgres-schema build && pnpm --filter @orca-cloud/push-contract build && pnpm --filter @orca-cloud/push build
 
-FROM node:24-alpine AS runtime
+FROM node:24.22.1-alpine AS runtime
 ENV NODE_ENV=production
 ENV PORT=8080
 WORKDIR /app
diff --git a/cloud/apps/relay-fence-broker/Dockerfile b/cloud/apps/relay-fence-broker/Dockerfile
index 6c452dac393..56ea54dcd4a 100644
--- a/cloud/apps/relay-fence-broker/Dockerfile
+++ b/cloud/apps/relay-fence-broker/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:24-bookworm-slim AS build
+FROM node:24.22.1-bookworm-slim AS build
 WORKDIR /workspace
 RUN corepack enable
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./
diff --git a/cloud/apps/relay/Dockerfile b/cloud/apps/relay/Dockerfile
index f0abcf9f5b3..6cd1abb1075 100644
--- a/cloud/apps/relay/Dockerfile
+++ b/cloud/apps/relay/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:24-alpine AS build
+FROM node:24.22.1-alpine AS build
 WORKDIR /app
 RUN corepack enable
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./
@@ -11,7 +11,7 @@ COPY apps/relay apps/relay
 COPY packages/postgres-schema packages/postgres-schema
 RUN pnpm --filter @orca-cloud/postgres-schema build && pnpm --filter @orca-cloud/relay-contract build && pnpm --filter @orca-cloud/relay build
 
-FROM node:24-alpine AS runtime
+FROM node:24.22.1-alpine AS runtime
 ENV NODE_ENV=production
 ENV PORT=8080
 WORKDIR /app
diff --git a/config/docker/daemon-scope-lifetime/Dockerfile b/config/docker/daemon-scope-lifetime/Dockerfile
index 918aacc18cc..21a83b20d44 100644
--- a/config/docker/daemon-scope-lifetime/Dockerfile
+++ b/config/docker/daemon-scope-lifetime/Dockerfile
@@ -1,5 +1,5 @@
 ARG BASE_IMAGE=debian:bookworm-slim
-FROM node:22-bookworm-slim AS node
+FROM node:22.23.4-bookworm-slim AS node
 FROM ${BASE_IMAGE}
 
 ENV DEBIAN_FRONTEND=noninteractive
diff --git a/config/docker/daemon-shutdown-descendants/Dockerfile b/config/docker/daemon-shutdown-descendants/Dockerfile
index 298678c6bc6..c0f08dd8bf3 100644
--- a/config/docker/daemon-shutdown-descendants/Dockerfile
+++ b/config/docker/daemon-shutdown-descendants/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:22-bookworm-slim
+FROM node:22.23.4-bookworm-slim
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV NODE_PATH=/usr/local/lib/node_modules
diff --git a/config/docker/headless-pairing/Dockerfile.build b/config/docker/headless-pairing/Dockerfile.build
index 01ca56f235d..38d0c7cfd77 100644
--- a/config/docker/headless-pairing/Dockerfile.build
+++ b/config/docker/headless-pairing/Dockerfile.build
@@ -1,4 +1,4 @@
-FROM node:24-bookworm
+FROM node:24.22.1-bookworm
 
 ENV DEBIAN_FRONTEND=noninteractive
 
diff --git a/config/docker/linux-lid-sleep-assertion/Dockerfile b/config/docker/linux-lid-sleep-assertion/Dockerfile
index fbee9570fe2..4e7f84204b2 100644
--- a/config/docker/linux-lid-sleep-assertion/Dockerfile
+++ b/config/docker/linux-lid-sleep-assertion/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:22-bookworm-slim
+FROM node:22.23.4-bookworm-slim
 
 ENV container=docker
 ENV ORCA_BACKGROUND_LAUNCH=1
diff --git a/config/scripts/benchmark-windows-native-preparation.mjs b/config/scripts/benchmark-windows-native-preparation.mjs
index e9ddc533290..0970c01cb22 100644
--- a/config/scripts/benchmark-windows-native-preparation.mjs
+++ b/config/scripts/benchmark-windows-native-preparation.mjs
@@ -180,7 +180,7 @@ export async function benchmarkWindowsNativePreparation(
 ) {
   assert.equal(process.platform, 'win32', 'This hosted comparison requires Windows')
   assert(['x64', 'arm64'].includes(process.arch), 'Unsupported Windows runner')
-  assert.equal(process.versions.node, '24.21.0', 'Comparison requires pinned Node')
+  assert.equal(process.versions.node, '24.22.1', 'Comparison requires pinned Node')
   assert(
     !hasWindowsCompilerSelection(process.env),
     'Explicit compiler selection prevents a qualified automatic-capture comparison'
diff --git a/config/scripts/ci-unit-module-cache.test.mjs b/config/scripts/ci-unit-module-cache.test.mjs
index 31ee2d567e7..c054d4be878 100644
--- a/config/scripts/ci-unit-module-cache.test.mjs
+++ b/config/scripts/ci-unit-module-cache.test.mjs
@@ -174,7 +174,7 @@ it('runs full same-source controls serially with five four-worker shards and inc
   expect(warm.needs).toBe('producer')
   for (const job of [baseline, producer, warm]) {
     expect(job.uses).toBe('./.github/workflows/unit-tests.yml')
-    expect(job.with.node_versions).toBe('["24.21.0"]')
+    expect(job.with.node_versions).toBe('["24.22.1"]')
     expect(job.with.runner).toBe('ubuntu-24.04-arm')
     expect(JSON.parse(job.with.shards)).toEqual(
       Array.from({ length: 5 }, (_, index) => ({ index: index + 1, count: 5 }))
diff --git a/config/scripts/release-javascript-parity.mjs b/config/scripts/release-javascript-parity.mjs
index a3ff9577c3b..c82f562171e 100644
--- a/config/scripts/release-javascript-parity.mjs
+++ b/config/scripts/release-javascript-parity.mjs
@@ -94,6 +94,12 @@ export function annotateJavascriptParityFiles(root, files) {
     if (manifest) {
       content = JSON.stringify(normalizeManifestSourcePaths(JSON.parse(content)))
     }
+    if (file.path === 'renderer/.orca-web-client-files.json') {
+      const members = JSON.parse(content)
+      assert(Array.isArray(members) && members.every((member) => typeof member === 'string'))
+      // Asset aliases can change the order of this file inventory after hash normalization.
+      content = JSON.stringify(members.sort())
+    }
     return {
       ...file,
       comparablePath,
diff --git a/config/scripts/release-javascript-parity.test.mjs b/config/scripts/release-javascript-parity.test.mjs
index 5a4c62a4ac6..4b4bf6a1ec8 100644
--- a/config/scripts/release-javascript-parity.test.mjs
+++ b/config/scripts/release-javascript-parity.test.mjs
@@ -206,3 +206,27 @@ it('compares manifest keys without ordering differences while preserving import
   })
   expect(compareJavascriptParityFiles(before, changed)).toEqual(['renderer/.vite/manifest.json'])
 })
+
+it('compares web file membership after asset aliases change their sort order', () => {
+  const before = inventory({
+    'renderer/assets/App-AAAAAAAA.js': 'desktop()',
+    'renderer/assets/App-BBBBBBBB.js': 'web()',
+    'renderer/.orca-web-client-files.json': '["assets/App-AAAAAAAA.js","assets/App-BBBBBBBB.js"]'
+  })
+  const files = {
+    'renderer/assets/App-CCCCCCCC.js': 'web()',
+    'renderer/assets/App-DDDDDDDD.js': 'desktop()'
+  }
+  const after = inventory({
+    ...files,
+    'renderer/.orca-web-client-files.json': '["assets/App-CCCCCCCC.js","assets/App-DDDDDDDD.js"]'
+  })
+  expect(compareJavascriptParityFiles(before, after)).toEqual([])
+  const changed = inventory({
+    ...files,
+    'renderer/.orca-web-client-files.json': '["assets/App-CCCCCCCC.js"]'
+  })
+  expect(compareJavascriptParityFiles(before, changed)).toEqual([
+    'renderer/.orca-web-client-files.json'
+  ])
+})
diff --git a/config/scripts/windows-native-preparation-benchmark.test.mjs b/config/scripts/windows-native-preparation-benchmark.test.mjs
index 20c2ac9dd14..f2557c0db41 100644
--- a/config/scripts/windows-native-preparation-benchmark.test.mjs
+++ b/config/scripts/windows-native-preparation-benchmark.test.mjs
@@ -205,7 +205,7 @@ test('manual workflow freezes source and limits Windows occupancy without changi
     (step) => step.uses === './.github/actions/install-node-dependencies'
   )
   assert.equal(install.with['native-runtime'], 'none')
-  assert.equal(install.with['node-version'], '24.21.0')
+  assert.equal(install.with['node-version'], '24.22.1')
   assert.equal(install.with['cache-pnpm-store'], 'false')
   assert.equal(workflow.jobs.compare.steps.at(-1).if, 'always()')
   assert(!Object.hasOwn(workflow.jobs, 'verify'))
diff --git a/config/scripts/windows-security-reuse-benchmark.test.mjs b/config/scripts/windows-security-reuse-benchmark.test.mjs
index add6179a274..3c146cb0b1f 100644
--- a/config/scripts/windows-security-reuse-benchmark.test.mjs
+++ b/config/scripts/windows-security-reuse-benchmark.test.mjs
@@ -14,6 +14,7 @@ import { dirname, join } from 'node:path'
 import { runInNewContext } from 'node:vm'
 import { afterEach, expect, it, vi } from 'vitest'
 import { parse } from 'yaml'
+import { NODE_RUNTIME_PIN } from '../../src/shared/node-runtime-pin.ts'
 import { sha256Of } from './orcad-prebuild-slot-contents.mjs'
 import { peImage } from './windows-pe-image-fixture.mjs'
 import {
@@ -93,7 +94,7 @@ function windows(arch = 'x64') {
     ...process,
     platform: 'win32',
     arch,
-    versions: { ...process.versions, node: '24.21.0' }
+    versions: { ...process.versions, node: NODE_RUNTIME_PIN.version }
   })
   vi.stubEnv('SOURCE_SHA', sourceSha)
   vi.stubEnv('BENCHMARK_RUNNER', arch === 'x64' ? 'windows-2022' : 'windows-11-arm')
diff --git a/src/main/managed-server/install/orcad-remote-node-runtime-windows.test.ts b/src/main/managed-server/install/orcad-remote-node-runtime-windows.test.ts
index 897551fb99e..6e0f6014553 100644
--- a/src/main/managed-server/install/orcad-remote-node-runtime-windows.test.ts
+++ b/src/main/managed-server/install/orcad-remote-node-runtime-windows.test.ts
@@ -79,12 +79,12 @@ describe('Windows runtime store commands', () => {
       .toMatchInlineSnapshot(`
         "$ProgressPreference = 'SilentlyContinue'
         function Get-OrcaSha256([string]$p) { if (Test-Path -LiteralPath $p -PathType Leaf) { (Get-FileHash -LiteralPath $p -Algorithm SHA256).Hash.ToLowerInvariant() } else { "" } }
-        $runtimeDir = 'C:/Users/u/.orca-remote/runtimes/node-ba4e6d110e8c1592a1ecd390f6b05f3da124b13871a5be62b341a07a853c6c32'
-        $exe = 'C:/Users/u/.orca-remote/runtimes/node-ba4e6d110e8c1592a1ecd390f6b05f3da124b13871a5be62b341a07a853c6c32/node.exe'
-        $verified = 'C:/Users/u/.orca-remote/runtimes/node-ba4e6d110e8c1592a1ecd390f6b05f3da124b13871a5be62b341a07a853c6c32/.verified'
-        if ((Get-OrcaSha256 $exe) -eq 'ba4e6d110e8c1592a1ecd390f6b05f3da124b13871a5be62b341a07a853c6c32') {
+        $runtimeDir = 'C:/Users/u/.orca-remote/runtimes/node-d702daa815eabbff763c7d3808e235cf031cf2ca70211b56847bc72f51e240e5'
+        $exe = 'C:/Users/u/.orca-remote/runtimes/node-d702daa815eabbff763c7d3808e235cf031cf2ca70211b56847bc72f51e240e5/node.exe'
+        $verified = 'C:/Users/u/.orca-remote/runtimes/node-d702daa815eabbff763c7d3808e235cf031cf2ca70211b56847bc72f51e240e5/.verified'
+        if ((Get-OrcaSha256 $exe) -eq 'd702daa815eabbff763c7d3808e235cf031cf2ca70211b56847bc72f51e240e5') {
         if (Test-Path -LiteralPath $verified -PathType Leaf) { Write-Output 'ORCA_NODE_RUNTIME_READY'; exit 0 }
-        try { $adoptOut = ((& $exe --version 2>&1) | ForEach-Object { "$_" }) -join ''; if (($LASTEXITCODE -eq 0) -and ($adoptOut.Trim() -eq 'v24.21.0')) { [IO.File]::WriteAllText($verified, ''); Write-Output 'ORCA_NODE_RUNTIME_READY'; exit 0 } } catch { }
+        try { $adoptOut = ((& $exe --version 2>&1) | ForEach-Object { "$_" }) -join ''; if (($LASTEXITCODE -eq 0) -and ($adoptOut.Trim() -eq 'v24.22.1')) { [IO.File]::WriteAllText($verified, ''); Write-Output 'ORCA_NODE_RUNTIME_READY'; exit 0 } } catch { }
         }
         Write-Output 'ORCA_NODE_RUNTIME_MISSING'"
       `)
diff --git a/src/shared/node-runtime-pin.ts b/src/shared/node-runtime-pin.ts
index f4c9c56bc5f..270b27cf8ac 100644
--- a/src/shared/node-runtime-pin.ts
+++ b/src/shared/node-runtime-pin.ts
@@ -60,12 +60,12 @@ export type NodeRuntimeAsset = {
 
 // @generated-begin by config/scripts/update-node-runtime-pin.mjs
 export const NODE_RUNTIME_PIN: NodeRuntimePin = {
-  version: '24.21.0',
+  version: '24.22.1',
   electron: '43.7.8',
   napi: 10,
   headers: {
-    file: 'node-v24.21.0-headers.tar.gz',
-    sha256: '57c6bee2e30bbbee5bd51d6cc343eb992e174b56a2a1d0eab7a7510771c20ea2'
+    file: 'node-v24.22.1-headers.tar.gz',
+    sha256: '322e0a27db9088093ab8347bdc8c7e0aaa21dc9ed548390bf06b394494c09267'
   },
   windowsImportLibs: {
     'win32-arm64': {
@@ -82,69 +82,69 @@ export const NODE_RUNTIME_PIN: NodeRuntimePin = {
 export const NODE_RUNTIME_ASSETS: Record<ServerTarget, NodeRuntimeAsset> = {
   'darwin-arm64': {
     source: 'official',
-    archive: 'node-v24.21.0-darwin-arm64.tar.gz',
-    archiveSha256: 'bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057',
-    executableSha256: 'e4b5a3af0e05c75de2eae013904145f40fe7fc2a6e6f17510128bf45cca4e79b',
-    executableSize: 122129232
+    archive: 'node-v24.22.1-darwin-arm64.tar.gz',
+    archiveSha256: '89c682593d76cd44233fa53b1563264e7de9cbb189cad169135c5b4fadfbc0a7',
+    executableSha256: '6f32069480ec14d52b6d7b1f3c7124cfbbc46203abf5ddf5c65b127435f3f329',
+    executableSize: 122545856
   },
   'darwin-x64': {
     source: 'official',
-    archive: 'node-v24.21.0-darwin-x64.tar.gz',
-    archiveSha256: '1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097',
-    executableSha256: '7abcf39bd37ab251015337ff75304d7555f0d8e88c6e0fbf04bce8ce34636f49',
-    executableSize: 125270960
+    archive: 'node-v24.22.1-darwin-x64.tar.gz',
+    archiveSha256: 'd132557e7ee2b85af08b0c8c34338e65c6430f2238d01f727728ef42dc83b035',
+    executableSha256: 'cc6f41f72e3eb4460154952e56a35afdd96b6995cea51cd25e637355a2955a51',
+    executableSize: 125715808
   },
   'linux-arm64-glibc': {
     source: 'official',
-    archive: 'node-v24.21.0-linux-arm64.tar.gz',
-    archiveSha256: '724282c3b43aec998aa9527380465b45d229e021b58035f5f4f63095eabfe5d5',
-    executableSha256: '0f8949d1028f6d61506b2d5bc57e7e6fe893d7b1997509b7847294fc9c616584',
-    executableSize: 122893672
+    archive: 'node-v24.22.1-linux-arm64.tar.gz',
+    archiveSha256: '33c37be234ba8bee041961047b19160f4d7d0f164e8e246f78bdd10feff148b3',
+    executableSha256: 'c8c5721679d8d1a09e9987e345d5f9a64899bb85f7a384783ba8a93e6e62348a',
+    executableSize: 123377224
   },
   'linux-x64-glibc': {
     source: 'official',
-    archive: 'node-v24.21.0-linux-x64.tar.gz',
-    archiveSha256: '6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff',
-    executableSha256: '7fde7b8afa198da66257f42ee2001d874c7355631e6d1579a5fb5ef1f246df4c',
-    executableSize: 126595440
+    archive: 'node-v24.22.1-linux-x64.tar.gz',
+    archiveSha256: 'eb6728e77c576a35162c122c45ccadf224d89ff00abc8dae46cc2897c6002d7c',
+    executableSha256: 'e32e2d16081cf644f88392934288086e7662529d0d43277c34f7aad2207cfafb',
+    executableSize: 126879696
   },
   'linux-arm64-musl': {
     source: 'unofficial',
-    archive: 'node-v24.21.0-linux-arm64-musl.tar.gz',
-    archiveSha256: '3048b0811e158ca0d8672b59c839861763e144492980d8d29b369dfee45747e4',
-    executableSha256: 'fa2789559dbc3603794a229877c244d1c0d06625c124631611ca4e13eac765be',
-    executableSize: 128653768
+    archive: 'node-v24.22.1-linux-arm64-musl.tar.gz',
+    archiveSha256: '8254125825a3e5e834bd8a260dab4c8303f720464a741506ec27989b9ba1769b',
+    executableSha256: '211a0371ba3e565863ae5358ffd06bc4fb4ffb0e53689d82c9a5b286ab4ad8d1',
+    executableSize: 129067232
   },
   'linux-x64-musl': {
     source: 'official',
-    archive: 'node-v24.21.0-linux-x64-musl.tar.gz',
-    archiveSha256: '3d63405fc65a0d2d2976c1f0bc2fd27bb0bd07212469e705aac3f03ae5ab4c9c',
-    executableSha256: '2cd83acecc7693ce96bcb4e292ff4c80461b7490028a002abe5a28ac9892bc29',
-    executableSize: 132204408
+    archive: 'node-v24.22.1-linux-x64-musl.tar.gz',
+    archiveSha256: '9b250d29d6ab8ae38dd23019e2c04a6d6b2916ab1dad721c5f6e1da2b2901c6a',
+    executableSha256: '569128f3066ac7be59b10b9a0adef708def642ee37cbf9d560a9bdb68f872108',
+    executableSize: 132485920
   },
   'win32-arm64': {
     source: 'official',
-    archive: 'node-v24.21.0-win-arm64.zip',
-    archiveSha256: '8779b1bde1d39f8d420e3b57aa657b39891af434d3de44a919044cec06785921',
-    executableSha256: 'dff59da18b6ffe1bf1ca99e1d2af4906080c481740619f5b5098c0fca28bd9b7',
-    executableSize: 81881416
+    archive: 'node-v24.22.1-win-arm64.zip',
+    archiveSha256: 'a0c807319fede24c4a0d8f84564c82a619bd313b16b10c007c383c2609e99171',
+    executableSha256: '8bea91dc437fe01e7d92ef0efc6c9eaf654369aaba9b2d3e9841552ea7b95a00',
+    executableSize: 82150728
   },
   'win32-x64': {
     source: 'official',
-    archive: 'node-v24.21.0-win-x64.zip',
-    archiveSha256: '158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541',
-    executableSha256: 'ba4e6d110e8c1592a1ecd390f6b05f3da124b13871a5be62b341a07a853c6c32',
-    executableSize: 93580104
+    archive: 'node-v24.22.1-win-x64.zip',
+    archiveSha256: 'd2046d28c2c3dcd211ac5145c0bf30e2047ef9dfb306693c8c6e2eccd8b95fa5',
+    executableSha256: 'd702daa815eabbff763c7d3808e235cf031cf2ca70211b56847bc72f51e240e5',
+    executableSize: 93915464
   }
 }
 
 export const NODE_RUNTIME_COMPAT_ASSETS: Record<CompatServerTarget, NodeRuntimeAsset> = {
   'linux-x64-glibc217': {
     source: 'unofficial',
-    archive: 'node-v24.21.0-linux-x64-glibc-217.tar.gz',
-    archiveSha256: 'b1d164136d4b218d663e664f40ba5e260ebc07f90e2bd784c63a57d8c0e6aa8a',
-    executableSha256: '1e75c95b1af4ec41e83d75816856b205f00c9427fd7d2dadd81472b38ff53d2c',
-    executableSize: 139511096
+    archive: 'node-v24.22.1-linux-x64-glibc-217.tar.gz',
+    archiveSha256: '422ddeec2c08902a34ef80ae25de388c7b7e2920763030a5262d56b10675c570',
+    executableSha256: '6ecc984d4bd0ff3012e91efa39eaf5f7e519037d5b1cbab8a6e1bb5c7914e18a',
+    executableSize: 139795880
   }
 }
 // @generated-end
diff --git a/tests/e2e/fixtures/docker-ssh-host/Dockerfile b/tests/e2e/fixtures/docker-ssh-host/Dockerfile
index e6851f26981..2ba6d567846 100644
--- a/tests/e2e/fixtures/docker-ssh-host/Dockerfile
+++ b/tests/e2e/fixtures/docker-ssh-host/Dockerfile
@@ -1,5 +1,8 @@
+FROM node:22.23.4-bookworm@sha256:2bd396628eceb5c999a6e43731fab69d5fb98b94ba9d9d90b5f64575c5178765 AS patched-node
 FROM node:22-bookworm@sha256:5647be709086c696ff32edaaf1c70cd26d1da6ab2b39c32f3c7b4c4a31957e37
 
+COPY --from=patched-node /usr/local/bin/node /usr/local/bin/node
+
 # Why: immutable snapshot inputs keep the SSH/Git fixture identical across rebuild dates.
 RUN sed -i \
       -e 's|http://deb.debian.org/debian-security|https://snapshot.debian.org/archive/debian-security/20260713T000000Z|' \