diff --git a/README.md b/README.md
index dbf0e7d..4d3a904 100644
--- a/README.md
+++ b/README.md
@@ -82,7 +82,7 @@ This covers the normal font picker and the **Installed by you** flow. If you alr
 
 #### Prerequisites
 
-- **Node.js 20+** (or the script installs it locally)
+- **Node.js 22.12+** (or the script installs it locally)
 - **p7zip** — for extracting the Windows installer
 - **ImageMagick** — for icon conversion
 - **wget** — for downloading the installer
diff --git a/build.sh b/build.sh
index b87a6e0..2c95073 100755
--- a/build.sh
+++ b/build.sh
@@ -143,7 +143,7 @@ check_system_requirements() {
 
 	# Check for NVM and source it if found
 	if [[ -d $original_home/.nvm ]]; then
-		echo "Found NVM installation for user $original_user, checking for Node.js 20+..."
+		echo "Found NVM installation for user $original_user, checking for Node.js 22.12+..."
 		export NVM_DIR="$original_home/.nvm"
 		if [[ -s $NVM_DIR/nvm.sh ]]; then
 			# shellcheck disable=SC1091
@@ -244,7 +244,7 @@ parse_arguments() {
 check_dependencies() {
 	echo 'Checking dependencies...'
 	local deps_to_install=''
-	local common_deps='p7zip wget convert'
+	local common_deps='7z wget convert'
 	local all_deps="$common_deps"
 
 	# Add format-specific dependencies
@@ -255,12 +255,12 @@ check_dependencies() {
 
 	# Command-to-package mappings per distro family
 	declare -A debian_pkgs=(
-		[p7zip]='p7zip-full' [wget]='wget'
+		[7z]='p7zip-full' [wget]='wget'
 		[convert]='imagemagick'
 		[dpkg-deb]='dpkg-dev' [rpmbuild]='rpm'
 	)
 	declare -A rpm_pkgs=(
-		[p7zip]='p7zip p7zip-plugins' [wget]='wget'
+		[7z]='p7zip p7zip-plugins' [wget]='wget'
 		[convert]='ImageMagick'
 		[dpkg-deb]='dpkg' [rpmbuild]='rpm-build'
 	)
@@ -339,16 +339,18 @@ setup_nodejs() {
 
 	local node_version_ok=false
 	if command -v node &> /dev/null; then
-		local node_version node_major
+		local node_version node_major node_minor
 		node_version=$(node --version | cut -d'v' -f2)
 		node_major="${node_version%%.*}"
+		node_minor="${node_version#*.}"
+		node_minor="${node_minor%%.*}"
 		echo "System Node.js version: v$node_version"
 
-		if (( node_major >= 20 )); then
+		if (( node_major > 22 || (node_major == 22 && node_minor >= 12) )); then
 			echo "System Node.js version is adequate (v$node_version)"
 			node_version_ok=true
 		else
-			echo "System Node.js version is too old (v$node_version). Need v20+"
+			echo "System Node.js version is too old (v$node_version). Need v22.12+"
 		fi
 	else
 		echo 'Node.js not found in system'
@@ -360,10 +362,10 @@ setup_nodejs() {
 	fi
 
 	# Node.js version inadequate - install locally
-	echo 'Installing Node.js v20 locally in build directory...'
+	echo 'Installing Node.js v22 locally in build directory...'
 
 	local node_arch='x64'
-	local node_version_to_install='20.18.1'
+	local node_version_to_install='22.23.1'
 	local node_tarball="node-v${node_version_to_install}-linux-${node_arch}.tar.xz"
 	local node_url="https://nodejs.org/dist/v${node_version_to_install}/${node_tarball}"
 	local node_install_dir="$work_dir/node"
diff --git a/scripts/build-appimage.sh b/scripts/build-appimage.sh
index a5c3ad5..c01a7ec 100755
--- a/scripts/build-appimage.sh
+++ b/scripts/build-appimage.sh
@@ -246,56 +246,73 @@ cat > "$metadata_dir/${component_id}.appdata.xml" << EOF
 EOF
 echo "AppStream metadata created"
 
-# --- Get appimagetool ---
-appimagetool_path=''
+# --- Get appimagetool and Type-2 runtime ---
+# Pin and verify both artifacts. The maintained appimagetool otherwise downloads
+# a moving, unverified runtime during each build.
+readonly appimagetool_version='1.9.1'
+readonly runtime_version='20251108'
+
+case "$architecture" in
+	amd64)
+		tool_arch='x86_64'
+		appimagetool_sha256='ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0'
+		runtime_sha256='2fca8b443c92510f1483a883f60061ad09b46b978b2631c807cd873a47ec260d'
+		;;
+	arm64)
+		tool_arch='aarch64'
+		appimagetool_sha256='f0837e7448a0c1e4e650a93bb3e85802546e60654ef287576f46c71c126a9158'
+		runtime_sha256='00cbdfcf917cc6c0ff6d3347d59e0ca1f7f45a6df1a428a0d6d8a78664d87444'
+		;;
+	*)
+		echo "Unsupported architecture for appimagetool: $architecture" >&2
+		exit 1
+		;;
+esac
 
-if command -v appimagetool &> /dev/null; then
-	appimagetool_path=$(command -v appimagetool)
-	echo "Found appimagetool in PATH: $appimagetool_path"
-fi
+download_verified() {
+	local url="$1"
+	local output="$2"
+	local expected_sha256="$3"
 
-for arch in x86_64 aarch64; do
-	[[ -n $appimagetool_path ]] && break
-	local_path="$work_dir/appimagetool-${arch}.AppImage"
-	if [[ -f $local_path ]]; then
-		appimagetool_path="$local_path"
-		echo "Found downloaded ${arch} appimagetool: $appimagetool_path"
+	if [[ -f $output ]] && printf '%s  %s\n' "$expected_sha256" "$output" | sha256sum --check --status; then
+		echo "Using verified cached artifact: $output"
+		return
 	fi
-done
-
-if [[ -z $appimagetool_path ]]; then
-	echo 'Downloading appimagetool...'
-	case "$architecture" in
-		amd64) tool_arch='x86_64' ;;
-		arm64) tool_arch='aarch64' ;;
-		*)
-			echo "Unsupported architecture for appimagetool: $architecture" >&2
-			exit 1
-			;;
-	esac
-
-	appimagetool_url="https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-${tool_arch}.AppImage"
-	appimagetool_path="$work_dir/appimagetool-${tool_arch}.AppImage"
-
-	if wget -q -O "$appimagetool_path" "$appimagetool_url"; then
-		chmod +x "$appimagetool_path" || exit 1
-		echo "Downloaded appimagetool to $appimagetool_path"
-	else
-		echo "Failed to download appimagetool from $appimagetool_url" >&2
-		rm -f "$appimagetool_path"
+
+	echo "Downloading $url"
+	rm -f "$output"
+	if ! wget -q -O "$output" "$url"; then
+		echo "Failed to download $url" >&2
+		rm -f "$output"
 		exit 1
 	fi
-fi
+	if ! printf '%s  %s\n' "$expected_sha256" "$output" | sha256sum --check --status; then
+		echo "Checksum verification failed for $output" >&2
+		rm -f "$output"
+		exit 1
+	fi
+}
+
+appimagetool_path="$work_dir/appimagetool-${appimagetool_version}-${tool_arch}.AppImage"
+runtime_path="$work_dir/runtime-${runtime_version}-${tool_arch}"
+download_verified \
+	"https://github.com/AppImage/appimagetool/releases/download/${appimagetool_version}/appimagetool-${tool_arch}.AppImage" \
+	"$appimagetool_path" "$appimagetool_sha256"
+download_verified \
+	"https://github.com/AppImage/type2-runtime/releases/download/${runtime_version}/runtime-${tool_arch}" \
+	"$runtime_path" "$runtime_sha256"
+chmod +x "$appimagetool_path" || exit 1
 
 # --- Build AppImage ---
 echo 'Building AppImage...'
 output_filename="${package_name}-${version}-${architecture}.AppImage"
 output_path="$work_dir/$output_filename"
-export ARCH="$architecture"
+export ARCH="$tool_arch"
 echo "Using ARCH=$ARCH"
 
 echo 'Building AppImage without update information'
-if ! "$appimagetool_path" "$appdir_path" "$output_path"; then
+if ! APPIMAGE_EXTRACT_AND_RUN=1 "$appimagetool_path" \
+	--runtime-file "$runtime_path" "$appdir_path" "$output_path"; then
 	echo "Failed to build AppImage using $appimagetool_path" >&2
 	exit 1
 fi