diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index b716ac13..be28835c 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -33,9 +33,11 @@ jobs:
     - name: Set up Node
       uses: actions/setup-node@v4
       with:
-        node-version: '20.x'
+        node-version: '22.x'
     - name: Upgrade npm for trusted publishing
-      run: npm install -g npm@latest
+      # Pin the npm major version instead of tracking npm@latest so a new npm
+      # release with a higher Node engine requirement can't break this step.
+      run: npm install -g npm@11
     - name: Install PHP
       run: |
         brew update
diff --git a/action.yml b/action.yml
index 24b059df..e4e948f6 100644
--- a/action.yml
+++ b/action.yml
@@ -119,12 +119,16 @@ runs:
       if: ${{ env.JDEPLOY_SKIP_EXECUTION != 'true' }}
       uses: actions/setup-node@v4
       with:
-        node-version: '20.x'
+        node-version: '22.x'
         registry-url: 'https://registry.npmjs.org'
 
     - name: Upgrade npm for trusted publishing
-      if: ${{ env.JDEPLOY_SKIP_EXECUTION != 'true' }}
-      run: npm install -g npm@latest
+      # Only needed for npm trusted publishing (OIDC provenance); GitHub
+      # releases don't use it. Pin the major version rather than tracking
+      # npm@latest so a new npm release with a higher Node engine requirement
+      # can't break this step without a Node bump here.
+      if: ${{ env.JDEPLOY_SKIP_EXECUTION != 'true' && inputs.deploy_target == 'npm' }}
+      run: npm install -g npm@11
       shell: bash
 
     - name: Setup jDeploy Registry