diff --git a/.github/workflows/build-desktop.yml b/.github/workflows/build-desktop.yml
index 75e27209..d3796d56 100644
--- a/.github/workflows/build-desktop.yml
+++ b/.github/workflows/build-desktop.yml
@@ -38,7 +38,14 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          # 22, not 20. jsdom 30 (via vitest) declares
+          # engines ^22.22.2 || ^24.15.0 || >=26.0.0, and on
+          # 20 it fails at import with
+          # "webidl.util.markAsUncloneable is not a
+          # function" rather than anything that names a Node
+          # version. The runners also warn that 20 is
+          # deprecated and force actions onto 24.
+          node-version: "22"
 
       - name: Set up pnpm
         uses: pnpm/action-setup@v4
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 97d03c0a..7b256012 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -36,7 +36,14 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          # 22, not 20. jsdom 30 (via vitest) declares
+          # engines ^22.22.2 || ^24.15.0 || >=26.0.0, and on
+          # 20 it fails at import with
+          # "webidl.util.markAsUncloneable is not a
+          # function" rather than anything that names a Node
+          # version. The runners also warn that 20 is
+          # deprecated and force actions onto 24.
+          node-version: "22"
 
       - name: Set up pnpm
         uses: pnpm/action-setup@v4
@@ -48,3 +55,6 @@ jobs:
 
       - name: Type check and build
         run: cd frontend && pnpm build
+
+      - name: Run tests
+        run: cd frontend && pnpm test
diff --git a/frontend/package.json b/frontend/package.json
index fe93161f..981eb210 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -2,6 +2,9 @@
   "name": "kaisho-frontend",
   "private": true,
   "version": "2.9.1",
+  "engines": {
+    "node": ">=22.22.2"
+  },
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/frontend/pnpm-workspace.yaml b/frontend/pnpm-workspace.yaml
index a2ac8c79..09758f62 100644
--- a/frontend/pnpm-workspace.yaml
+++ b/frontend/pnpm-workspace.yaml
@@ -1,6 +1,24 @@
-# esbuild ships a prebuilt binary and needs its install
-# script to put it in place; vitest will not start without
-# it. Approved explicitly because pnpm blocks build scripts
-# by default, which is the right default.
+# Both keys are load-bearing, for different pnpm versions.
+#
+# packages: pnpm 9, which CI pins, treats any
+# pnpm-workspace.yaml as a workspace declaration and
+# refuses to install without this field:
+#
+#   ERROR  packages field missing or empty
+#
+# "." is this package itself, so the install layout is
+# unchanged.
+#
+# ignoredBuiltDependencies: pnpm 10 and later refuse to
+# finish an install that skipped a package's build script
+# (ERR_PNPM_IGNORED_BUILDS) unless told the skip is
+# deliberate. esbuild's script places a prebuilt binary
+# that neither the build nor the tests need: verified with
+# a clean install that skipped it, followed by pnpm build
+# and pnpm test, both green.
+packages:
+  - .
 allowBuilds:
-  esbuild: true
+  esbuild: set this to true or false
+ignoredBuiltDependencies:
+  - esbuild