diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cdd5c0b..641587b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,18 +19,18 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Set up pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - name: Set up Node
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          version: 9.15.0
+          node-version: '24.22.1'
 
-      - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - name: Set up pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
-          node-version: '24'
-          cache: pnpm
+          version: 9.15.0
+          cache: true
 
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
diff --git a/.github/workflows/powerpoint-oracle.yml b/.github/workflows/powerpoint-oracle.yml
index 284847d..fae27c4 100644
--- a/.github/workflows/powerpoint-oracle.yml
+++ b/.github/workflows/powerpoint-oracle.yml
@@ -15,14 +15,14 @@ jobs:
     runs-on: self-hosted
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          version: 9.15.0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+          node-version: '24.22.1'
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
-          node-version: '24'
-          cache: pnpm
+          version: 9.15.0
+          cache: true
       - run: pnpm install --frozen-lockfile
       - run: pnpm powerpoint-oracle:validate
       - run: pnpm powerpoint-oracle:compare
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4814977..20cb524 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -25,12 +25,19 @@ jobs:
       version: ${{ steps.meta.outputs.version }}
     steps:
       - name: Check out the release commit
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
           ref: ${{ github.sha }}
 
+      - name: Set up Node
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: '24.22.1'
+          package-manager-cache: false
+          registry-url: https://registry.npmjs.org
+
       - name: Read release metadata
         id: meta
         run: |
@@ -55,17 +62,10 @@ jobs:
           NODE
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           version: 9.15.0
 
-      - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: '24'
-          package-manager-cache: false
-          registry-url: https://registry.npmjs.org
-
       - name: Check npm publish state
         id: npm_state
         run: |
@@ -194,16 +194,16 @@ jobs:
       USE_NPM_TOKEN: ${{ vars.NPM_PUBLISH_USE_TOKEN == 'true' && 'true' || 'false' }}
     steps:
       - name: Check out the release commit
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
           ref: ${{ github.sha }}
 
       - name: Set up Node and npm registry
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '24'
+          node-version: '24.22.1'
           package-manager-cache: false
           registry-url: https://registry.npmjs.org
 
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..b6f27f1
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1 @@
+engine-strict=true
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 0000000..ce62013
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+24.22.1
diff --git a/README.md b/README.md
index df35306..261bd89 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,10 @@ and a virtualized HTML/SVG rendering engine.
 
 ## Run the playground
 
+Use Node.js 24.22.1 (pinned in `.nvmrc`) and pnpm 9.15.0. Node.js 22.23.4 or
+newer within the 22.x release line is also supported. Dependency installation
+rejects older runtimes.
+
 ```bash
 pnpm install
 pnpm dev
diff --git a/package.json b/package.json
index 128c176..1dfa8c0 100644
--- a/package.json
+++ b/package.json
@@ -52,5 +52,15 @@
     "overrides": {
       "esbuild": "0.28.1"
     }
+  },
+  "engines": {
+    "node": ">=22.23.4 <23 || >=24.22.1 <25"
+  },
+  "devEngines": {
+    "runtime": {
+      "name": "node",
+      "version": ">=22.23.4 <23 || >=24.22.1 <25",
+      "onFail": "error"
+    }
   }
 }