diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a0ce50a..763ddbf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -66,9 +66,11 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # Node 22 is the baseline: jsdom 30 (the vitest DOM environment) requires
+      # ^22.22.2 || ^24.15.0 || >=26.0.0, and Node 20 is past end-of-life.
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '20'
+          node-version: '22'
 
       - name: Install dependencies
         run: npm ci --ignore-scripts
@@ -153,7 +155,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '20'
+          node-version: '22'
 
       # The e2eTest task executes the wrapper jar (directly and again nested, when Playwright boots
       # the demo via the Gradle `run` task) — validate it for the same reason the build job does.
diff --git a/CLAUDE.md b/CLAUDE.md
index 9f9a31a..b05aaff 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -10,7 +10,7 @@ The canonical architecture reference is [`DESIGN.md`](./DESIGN.md); per-decision
 
 ## Build & test
 
-JDK 21 is required (Gradle's toolchain fetches one if absent). Node ≥ 20 + npm are needed for the browser SDK, which Gradle drives automatically.
+JDK 21 is required (Gradle's toolchain fetches one if absent). Node ≥ 22.22.2 + npm are needed for the browser SDK, which Gradle drives automatically.
 
 ```sh
 ./gradlew check                          # full gate: spotlessCheck + test + jacoco coverage verify
diff --git a/README.md b/README.md
index 4d168fc..414c907 100644
--- a/README.md
+++ b/README.md
@@ -139,7 +139,7 @@ docs/                          # ADRs, operator guide, threat model
 Requirements:
 
 - **JDK 21** — Gradle's toolchain will fetch one if not present.
-- **Node ≥ 20** + **npm** — for the browser SDK build, invoked
+- **Node ≥ 22.22.2** + **npm** — for the browser SDK build, invoked
   automatically by Gradle (`./gradlew :buildPasskeysBrowserSdk`).
 
 Optional, only needed for the JDBI / DynamoDB persistence integration
diff --git a/RELEASE.md b/RELEASE.md
index 350271f..2722318 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -157,7 +157,7 @@ release version (the SDK speaks the same wire contract as that server release).
 
 ### Prerequisites (one-time)
 
-- **Node ≥ 20 + npm** (same toolchain the Gradle SDK build uses).
+- **Node ≥ 22.22.2 + npm** (same toolchain the Gradle SDK build uses).
 - An **npm account** that is a member of the `@pk-auth` org/scope with publish
   rights. The package is public scoped (`publishConfig.access = "public"` is set
   in `package.json`, so no `--access public` flag is needed).
diff --git a/clients/passkeys-browser/package.json b/clients/passkeys-browser/package.json
index 5e03ad4..5b74a47 100644
--- a/clients/passkeys-browser/package.json
+++ b/clients/passkeys-browser/package.json
@@ -42,7 +42,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22.22.2"
   },
   "scripts": {
     "build": "tsup",