diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 54dbd01..664a561 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,16 +16,13 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v5
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+      - name: Setup pnpm + Node.js
+        uses: pnpm/setup@v2
         with:
-          version: 9
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v5
-        with:
-          node-version: 22
-          cache: pnpm
+          version: next-12
+          runtime: node@22
+          cache: true
+          install: false
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index d9d79f7..6d771e0 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -21,10 +21,13 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v5
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v5
+      - name: Setup pnpm + Node.js
+        uses: pnpm/setup@v2
         with:
-          node-version: 22
+          version: next-12
+          runtime: node@22
+          cache: true
+          install: false
 
       - name: Validate release tag
         env:
@@ -40,14 +43,6 @@ jobs:
             exit 1
           fi
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
-
-      - name: Enable pnpm
-        run: corepack enable
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
diff --git a/AGENTS.md b/AGENTS.md
index 70e9448..4dccff6 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -91,7 +91,7 @@ toskd/
 │   └── test-admin-password-change.mjs             # Ganti kata sandi admin: 401/OPTIONS/validasi 400/min-8/new==current/404/500 + hash bcrypt ter-update + sesi tetap valid + edge multi-tab (mock PostgREST stateful mutatif)
 ├── schema.sql                    # Skema database Supabase (termasuk tabel admins + option_scores + subtests + subtest_thresholds)
 ├── supabase/                     # Supabase CLI: config.toml + migrations/ (8 file: 000-007) + seed.sql (di-track sejak 2026-08-15)
-├── pnpm-workspace.yaml           # Config pnpm: packages ["."] (kompat pnpm 9) + allowBuilds protobufjs (pnpm 10+/11)
+├── pnpm-workspace.yaml           # Config pnpm: packages ["."] (kompat pnpm 12) + allowBuilds protobufjs (pnpm 10+)
 ├── Dockerfile                    # Multi-stage Docker build (node:22-alpine, non-root, tini init, HEALTHCHECK)
 ├── docker-compose.yaml           # Self-host: service toskd di network eksternal net1 (Caddy reverse-proxy), env dari .env.container
 ├── .dockerignore                 # Exclude unnecessary or sensitive files
diff --git a/Dockerfile b/Dockerfile
index d941add..56b45f6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,13 +5,14 @@ FROM node:22-alpine AS deps
 
 ENV PNPM_HOME="/pnpm"
 ENV PATH="$PNPM_HOME:$PATH"
-RUN corepack enable && corepack prepare pnpm@9 --activate
+RUN corepack enable && corepack prepare pnpm@next-12 --activate
 
 WORKDIR /app
 
 # Cache pnpm store across builds (BuildKit required)
 # pnpm-workspace.yaml ikut di-copy: memuat allowBuilds protobufjs (dibutuhkan
-# pnpm 10+/11; pnpm 9 mengabaikannya dengan aman — single-package workspace).
+# pnpm 10+/12; pnpm 9 mengabaikannya — single-package workspace).
+# pnpm 12 di-install dari tag next-12 (latest npm masih menunjuk pnpm 11).
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
     pnpm install --frozen-lockfile --prod
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index b0eb767..f2e3fbc 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,11 +1,12 @@
 # pnpm workspace config.
-# - `packages: ["."]` wajib ada agar pnpm 9 (Dockerfile + CI) tetap mengenali
+# - `packages: ["."]` wajib ada agar pnpm (CI + Dockerfile) tetap mengenali
 #   project ini sebagai single-package workspace tanpa error
 #   "packages field missing or empty".
-# - `allowBuilds: protobufjs: true` diperlukan pnpm 10+/11 (local dev):
+# - `allowBuilds: protobufjs: true` diperlukan pnpm 10+/12 (CI + Dockerfile,
+#   termasuk local dev):
 #   protobufjs@7 butuh postinstall utk dipakai eksporter OTLP protobuf
 #   (ter-bundle di @opentelemetry/sdk-node → exporter-*-otlp-proto).
-#   Tanpa ini pnpm 11 menganggap build di-ignore dan
+#   Tanpa ini pnpm menganggap build di-ignore dan
 #   `pnpm install`/`pnpm test` (deps status check) gagal dengan
 #   ERR_PNPM_IGNORED_BUILDS.
 packages: