diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6182646..2d2d03b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version-file: '.tool-versions'
 
       - name: Spectral lint the OpenAPI contract
         run: pnpm dlx @stoplight/spectral-cli@6 lint packages/embed/openapi/embed.openapi.yaml --ruleset packages/embed/openapi/.spectral.yaml
@@ -34,7 +34,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version-file: '.tool-versions'
           cache: pnpm
 
       - run: pnpm install --frozen-lockfile
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ba3521e..919464e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,14 +25,9 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version-file: '.tool-versions'
           cache: pnpm
 
-      # Trusted publishing + `--provenance` require npm >= 11.5.
-      # setup-node ships npm 10.x, so upgrade explicitly.
-      - name: Upgrade npm
-        run: npm install -g npm@latest
-
       - run: pnpm install --frozen-lockfile
 
       - run: pnpm run build
diff --git a/.tool-versions b/.tool-versions
new file mode 100644
index 0000000..49c192d
--- /dev/null
+++ b/.tool-versions
@@ -0,0 +1,2 @@
+nodejs 24.19.0
+pnpm 11.20.0
diff --git a/package.json b/package.json
index 595033d..8cd3b28 100644
--- a/package.json
+++ b/package.json
@@ -14,10 +14,10 @@
 	"bugs": {
 		"url": "https://github.com/monad-inc/embed/issues"
 	},
-	"packageManager": "pnpm@9.15.0",
+	"packageManager": "pnpm@11.20.0",
 	"engines": {
-		"node": ">=20",
-		"pnpm": ">=9"
+		"node": ">=24.19.0 <25",
+		"pnpm": ">=11"
 	},
 	"scripts": {
 		"build": "pnpm -r run build",
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 18ec407..3dfc6fe 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,2 +1,7 @@
 packages:
   - 'packages/*'
+# pnpm 10+ blocks dependency lifecycle scripts by default; allowBuilds is the
+# pnpm 11 replacement for onlyBuiltDependencies. esbuild (used by tsup) is
+# non-functional without its install script.
+allowBuilds:
+  esbuild: true