diff --git a/.github/workflows/likec4-pages.yml b/.github/workflows/likec4-pages.yml
index 393dfd99..a0cc09d5 100644
--- a/.github/workflows/likec4-pages.yml
+++ b/.github/workflows/likec4-pages.yml
@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24.21.0'
       - name: Check model source links resolve (drift guard)
         run: node architecture/site/check-links.mjs
       - uses: likec4/actions@v1
diff --git a/src/codeprobe/sandbox/Dockerfile.agent b/src/codeprobe/sandbox/Dockerfile.agent
index 9e918434..a6362e10 100644
--- a/src/codeprobe/sandbox/Dockerfile.agent
+++ b/src/codeprobe/sandbox/Dockerfile.agent
@@ -8,7 +8,7 @@
 # run with --network=bridge: the agent must reach the model API. Only the
 # slot worktree and the session CLAUDE_CONFIG_DIR are mounted rw; the rest
 # of the container filesystem is throwaway.
-FROM node:22-bookworm-slim@sha256:6c74791e557ce11fc957704f6d4fe134a7bc8d6f5ca4403205b2966bd488f6b3
+FROM node:24.21.0-bookworm-slim@sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6
 
 ARG DEBIAN_SNAPSHOT=20260728T000000Z
 ARG CLAUDE_CODE_VERSION=2.1.220