diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml
index 19fef9202..f0e780544 100644
--- a/.github/workflows/linting.yml
+++ b/.github/workflows/linting.yml
@@ -34,9 +34,9 @@ jobs:
               uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
               with:
                 # Match the version the app ships on (Dockerfile /
-                # Dockerfile.dev both use 24.18.1) rather than floating
+                # Dockerfile.dev both use 24.22.1) rather than floating
                 # to the latest 24.x.
-                node-version: '24.18.1'
+                node-version: '24.22.1'
 
             - name: Install dependencies
               run: npm ci
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index bcfe95ee0..71314648a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -20,12 +20,12 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           # Pin to the version the app actually ships on (Dockerfile /
-          # Dockerfile.dev both use 24.18.1; .nvmrc pins the 24 major).
+          # Dockerfile.dev both use 24.22.1; .nvmrc pins the 24 major).
           # A bare '24' floats to the latest 24.x; Node >= 24.19.0 added
           # node::ObjectWrap cleanup hooks that crash better-sqlite3 on teardown
           # ("Assertion failed: (env) != nullptr" in RemoveEnvironmentCleanupHook),
           # which intermittently kills `npm run dev` in the step below.
-          node-version: '24.18.1'
+          node-version: '24.22.1'
 
       - name: Copy config file
         run: cp config/config.example.yml config/config.yml
diff --git a/Dockerfile b/Dockerfile
index 139250cee..aff11ae4e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
-# FROM node:24.18.1-slim AS base
-FROM public.ecr.aws/docker/library/node:24.18.1-slim AS base
+# FROM node:24.22.1-slim AS base
+FROM public.ecr.aws/docker/library/node:24.22.1-slim AS base
 
 WORKDIR /app
 
@@ -35,8 +35,8 @@ RUN npm prune --omit=dev && \
 # Real files should be present for saas builds, placeholders for oss builds
 RUN touch /app/GeoLite2-Country.mmdb /app/GeoLite2-ASN.mmdb
 
-# FROM node:24.18.1-slim AS runner
-FROM public.ecr.aws/docker/library/node:24.18.1-slim AS runner
+# FROM node:24.22.1-slim AS runner
+FROM public.ecr.aws/docker/library/node:24.22.1-slim AS runner
 
 WORKDIR /app
 
diff --git a/Dockerfile.dev b/Dockerfile.dev
index cfcfb278a..7874b6c55 100644
--- a/Dockerfile.dev
+++ b/Dockerfile.dev
@@ -1,4 +1,4 @@
-FROM node:24.18.1-alpine
+FROM node:24.22.1-alpine
 
 WORKDIR /app