diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index a20fb5f..7517cff 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -28,10 +28,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Use Node.js 18.x
+      - name: Use Node.js 24.x
         uses: actions/setup-node@v4
         with:
-          node-version: 18.x
+          node-version: 24.x
 
       - name: Build App
         run: |
@@ -61,10 +61,10 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Use Node.js 18.x
+      - name: Use Node.js 24.x
         uses: actions/setup-node@v4
         with:
-          node-version: 18.x
+          node-version: 24.x
 
       - name: Install dependencies
         run: yarn install --frozen-lockfile
@@ -113,10 +113,10 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Use Node.js 18.x
+      - name: Use Node.js 24.x
         uses: actions/setup-node@v4
         with:
-          node-version: 18.x
+          node-version: 24.x
 
       - name: Install dependencies
         run: yarn install --frozen-lockfile
diff --git a/Dockerfile b/Dockerfile
index 2f30452..b86c19b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -32,7 +32,13 @@
 #   docker run --rm -p 3001:3000 gofr-website:local
 
 # ---------- builder ----------
-FROM node:23.11.1-alpine3.21 AS builder
+# Node 24 is the active LTS (EOL 2028-04-30). Tracked as the major tag
+# rather than an exact patch pin: this repo has no Renovate/Dependabot,
+# and the previous exact pin (node:23.11.1-alpine3.21) silently outlived
+# its line — v23 was never LTS and went EOL 2025-06-01. A floating major
+# picks up patch + Alpine security updates on rebuild and only needs a
+# human when the major itself goes EOL.
+FROM node:24-alpine AS builder
 
 RUN apk add --no-cache libc6-compat