diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 52a2c409..0f2f0c52 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -18,11 +18,20 @@ jobs:
             - name: Setup pnpm
               uses: pnpm/action-setup@v4
 
-            - name: Setup Node.js
-              uses: actions/setup-node@v4
+            # Toolchains come from mise.toml, read here by mise-action so the runner
+            # and a developer's shell resolve identical versions.
+            - name: Setup toolchains (mise)
+              uses: jdx/mise-action@v4
+
+            - name: Locate pnpm store
+              run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
+
+            - name: Cache pnpm store
+              uses: actions/cache@v4
               with:
-                  node-version: 22
-                  cache: 'pnpm'
+                  path: ${{ env.STORE_PATH }}
+                  key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+                  restore-keys: ${{ runner.os }}-pnpm-store-
 
             - name: Install dependencies
               run: pnpm install
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5eaf1bfe..82eaa8f4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,11 +28,20 @@ jobs:
             - name: Setup pnpm
               uses: pnpm/action-setup@v4
 
-            - name: Setup node.js
-              uses: actions/setup-node@v4
+            # Toolchains come from mise.toml, read here by mise-action so the runner
+            # and a developer's shell resolve identical versions.
+            - name: Setup toolchains (mise)
+              uses: jdx/mise-action@v4
+
+            - name: Locate pnpm store
+              run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
+
+            - name: Cache pnpm store
+              uses: actions/cache@v4
               with:
-                  node-version: 22
-                  cache: 'pnpm'
+                  path: ${{ env.STORE_PATH }}
+                  key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+                  restore-keys: ${{ runner.os }}-pnpm-store-
 
             - name: Install dependencies
               run: pnpm install
diff --git a/mise.toml b/mise.toml
new file mode 100644
index 00000000..47009c22
--- /dev/null
+++ b/mise.toml
@@ -0,0 +1,11 @@
+# Toolchain versions for this repo — read by mise locally and by
+# jdx/mise-action in CI, so a developer's shell and the runner agree.
+#
+# Not listed here on purpose:
+#   pnpm  -> package.json "packageManager". pnpm self-substitutes to that
+#            version regardless of which pnpm binary launches it, so a mise
+#            pin would be cosmetic and would drift.
+#   rust  -> rust-toolchain.toml + dtolnay/rust-toolchain. rustup is canonical
+#            and mise defers to it anyway.
+[tools]
+node = "24.14.0" # ships npm 11.9.0 — required (>=11.5.1) for npm OIDC trusted publishing
diff --git a/package.json b/package.json
index 05c91e0f..fb1fac7f 100644
--- a/package.json
+++ b/package.json
@@ -117,5 +117,5 @@
     "engines": {
         "node": ">=20.0.0"
     },
-    "packageManager": "pnpm@10.6.1+sha512.40ee09af407fa9fbb5fbfb8e1cb40fbb74c0af0c3e10e9224d7b53c7658528615b2c92450e74cfad91e3a2dcafe3ce4050d80bda71d757756d2ce2b66213e9a3"
+    "packageManager": "pnpm@10.34.5"
 }