diff --git a/.mise.toml b/.mise.toml
index a4a7d62..0353746 100644
--- a/.mise.toml
+++ b/.mise.toml
@@ -8,7 +8,7 @@
 # bump NODE_VERSION there, bump it here too.
 
 [tools]
-node = "22.20.0"
+node = "22.23.4"
 zizmor = "1.29.0"     # GitHub Actions security audit
 actionlint = "1.7.12" # GitHub Actions schema + expression lint
 
diff --git a/AGENTS.md b/AGENTS.md
index 0b7fe25..5fba90a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -58,7 +58,7 @@ that is a real choice.
 
 ## Development commands
 
-Use `mise`. It pins the toolchain — including Node `22.20.0`, the same version
+Use `mise`. It pins the toolchain — including Node `22.23.4`, the same version
 `packaging/assemble.sh` bundles into the `.deb` — and CI runs the same tasks, so
 local and CI cannot drift.
 
diff --git a/packaging/assemble.sh b/packaging/assemble.sh
index 928e0ed..60c097a 100755
--- a/packaging/assemble.sh
+++ b/packaging/assemble.sh
@@ -9,7 +9,7 @@ set -euo pipefail
 
 cd "$(dirname "$0")/.."  # repo root
 
-NODE_VERSION="${NODE_VERSION:-22.20.0}"   # current Node LTS line — override if newer
+NODE_VERSION="${NODE_VERSION:-22.23.4}"   # current Node LTS line — override if newer
 NODE_ARCH="${NODE_ARCH:-arm64}"
 STAGE="build/stage"
 OPT="$STAGE/opt/penplotter271"