diff --git a/.woodpecker/ci.yml b/.woodpecker/ci.yml
index 46a839f..ce4d4da 100644
--- a/.woodpecker/ci.yml
+++ b/.woodpecker/ci.yml
@@ -1,5 +1,5 @@
 # &node_image is the pre-baked CI base built by .woodpecker/ci-image.yml:
-# node:22-alpine + python3/make/g++/postgresql-client + pnpm + a warm pnpm
+# node:24-alpine + python3/make/g++/postgresql-client + pnpm + a warm pnpm
 # store. The install step resolves from the baked store (--prefer-offline)
 # instead of paying a ~731s cold fetch + native compile every run.
 variables:
diff --git a/.woodpecker/publish.yml b/.woodpecker/publish.yml
index 9adc6e3..cdc84d0 100644
--- a/.woodpecker/publish.yml
+++ b/.woodpecker/publish.yml
@@ -2,7 +2,7 @@
 # Runs only on main branch push/tag
 
 variables:
-  # Pre-baked CI base (see .woodpecker/ci-image.yml): node:22-alpine +
+  # Pre-baked CI base (see .woodpecker/ci-image.yml): node:24-alpine +
   # toolchain + warm pnpm store. Kills the second cold install publish pays.
   - &node_image 'git.mosaicstack.dev/mosaicstack/stack/ci-base:latest'
   - &enable_pnpm 'corepack enable'
diff --git a/Dockerfile.ci b/Dockerfile.ci
index b0f8b81..4bb9d7a 100644
--- a/Dockerfile.ci
+++ b/Dockerfile.ci
@@ -14,10 +14,12 @@
 # Rebuilt only when `pnpm-lock.yaml` or this Dockerfile change
 # (see .woodpecker/ci-image.yml).
 #
-# Node version is intentionally pinned to 22 (Active LTS at time of writing).
-# The node:22 -> node:24 bump lands as a SEPARATE follow-up PR so the cache
-# change carries zero runtime-version variables.
-FROM node:22-alpine
+# Node version is pinned to 24 (Active LTS). This is the follow-up bump from
+# node:22 — sequenced AFTER the CI cache work landed so the runtime change
+# carries zero cache variables. node:26 stays held until it reaches LTS
+# (Oct 2026); the Current line risks native-module (node-gyp) breakage on a
+# runner that compiles better-sqlite3 / canvas / sharp / node-pty from source.
+FROM node:24-alpine
 
 # Native toolchain required to compile node-gyp deps on musl, plus the
 # postgresql-client used by the test step's pg_isready readiness probe. `bash`