diff --git a/.github/workflows/cli-build.yml b/.github/workflows/cli-build.yml
index fff8ae74c..33ffe585c 100644
--- a/.github/workflows/cli-build.yml
+++ b/.github/workflows/cli-build.yml
@@ -17,8 +17,8 @@ permissions:
 env:
   SENTRY_CLIENT_ID: ${{ vars.SENTRY_CLIENT_ID }}
   NODE_VERSION_20: "20.20.2"
-  NODE_VERSION_22: "22.23.1"
-  NODE_VERSION_24: "24.18.0"
+  NODE_VERSION_22: "22.23.4"
+  NODE_VERSION_24: "24.22.1"
 
 jobs:
   nightly-version:
diff --git a/.github/workflows/cli-nightly-watchdog.yml b/.github/workflows/cli-nightly-watchdog.yml
index 7029652a2..42a2d86bf 100644
--- a/.github/workflows/cli-nightly-watchdog.yml
+++ b/.github/workflows/cli-nightly-watchdog.yml
@@ -38,7 +38,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: "24.18.0"
+          node-version: "24.22.1"
       - name: Assess nightly publishing
         id: assess
         env:
diff --git a/.github/workflows/install-scripts.yml b/.github/workflows/install-scripts.yml
index e91c635ff..d9d6a603b 100644
--- a/.github/workflows/install-scripts.yml
+++ b/.github/workflows/install-scripts.yml
@@ -94,7 +94,7 @@ jobs:
       - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: "22.23.1"
+          node-version: "22.23.4"
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - name: Run the registry-backed tests
diff --git a/.github/workflows/local.yml b/.github/workflows/local.yml
index 2a90a09ac..c287154ad 100644
--- a/.github/workflows/local.yml
+++ b/.github/workflows/local.yml
@@ -40,7 +40,7 @@ jobs:
       - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: "22.23.1"
+          node-version: "22.23.4"
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - name: Viewer integration tests
diff --git a/.github/workflows/pr-risk-labels-test.yml b/.github/workflows/pr-risk-labels-test.yml
index e3c082354..5f54f625d 100644
--- a/.github/workflows/pr-risk-labels-test.yml
+++ b/.github/workflows/pr-risk-labels-test.yml
@@ -24,5 +24,5 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
-          node-version: "24.18.0"
+          node-version: "24.22.1"
       - run: node --test .github/tests/pr-risk-labels.test.mjs
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 39bcb5959..47402b236 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -11,8 +11,8 @@ permissions:
 
 env:
   NODE_VERSION_20: "20.20.2"
-  NODE_VERSION_22: "22.23.1"
-  NODE_VERSION_24: "24.18.0"
+  NODE_VERSION_22: "22.23.4"
+  NODE_VERSION_24: "24.22.1"
 
 jobs:
   discover-projects:
diff --git a/scripts/ci-projects.test.mjs b/scripts/ci-projects.test.mjs
index 35c00fdf8..cc1396274 100644
--- a/scripts/ci-projects.test.mjs
+++ b/scripts/ci-projects.test.mjs
@@ -193,8 +193,8 @@ describe("workspace CI selection", () => {
     assert.match(workflow, /Validate packaged runtime on Node 22/);
     assert.match(workflow, /Validate packaged runtime on Node 24/);
     assert.match(workflow, /NODE_VERSION_20: "20\.20\.2"/);
-    assert.match(workflow, /NODE_VERSION_22: "22\.23\.1"/);
-    assert.match(workflow, /NODE_VERSION_24: "24\.18\.0"/);
+    assert.match(workflow, /NODE_VERSION_22: "22\.23\.4"/);
+    assert.match(workflow, /NODE_VERSION_24: "24\.22\.1"/);
     assert.match(workflow, /RUNTIME_RESULT.*needs\.npm-runtime\.result/);
     assert.match(workflow, /name: Verify JUnit/);
     assert.match(workflow, /name: Verify coverage/);