diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 622fe2f..e127a42 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,16 +21,17 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          # This job runs PR-provided code; don't leave the checkout token in
-          # the workspace git config.
           persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
 
+      - name: Refresh lockfile
+        run: npm install --package-lock-only --ignore-scripts --no-audit --no-fund
+
       - name: Install dependencies
         run: npm ci
 
@@ -57,10 +58,6 @@ jobs:
           path: dist/bundle-report.md
           if-no-files-found: ignore
 
-  # Dedicated, named check so the accessibility gate is visible on every PR.
-  # The full suite in `verify` already runs these tests; this job surfaces them
-  # as their own status check (mark it required in branch protection to block
-  # merges on a violation).
   accessibility:
     name: Accessibility (axe-core)
     runs-on: ubuntu-latest
@@ -69,21 +66,19 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          # This job runs PR-provided code; don't leave the checkout token in
-          # the workspace git config.
           persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
 
+      - name: Refresh lockfile
+        run: npm install --package-lock-only --ignore-scripts --no-audit --no-fund
+
       - name: Install dependencies
         run: npm ci
 
-      # Renders the public components/pages in jsdom and runs axe-core against
-      # each. A new WCAG violation (missing label/alt, bad ARIA, skipped heading
-      # level, …) fails this job.
       - name: Run accessibility tests
         run: npm run test:a11y
diff --git a/.github/workflows/firebase-preview.yml b/.github/workflows/firebase-preview.yml
index 091c699..599515d 100644
--- a/.github/workflows/firebase-preview.yml
+++ b/.github/workflows/firebase-preview.yml
@@ -25,9 +25,12 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
 
+      - name: Refresh lockfile
+        run: npm install --package-lock-only --ignore-scripts --no-audit --no-fund
+
       - name: Install dependencies
         run: npm ci
 
diff --git a/.github/workflows/security-check.yml b/.github/workflows/security-check.yml
index aed4c8c..fb0e472 100644
--- a/.github/workflows/security-check.yml
+++ b/.github/workflows/security-check.yml
@@ -2,7 +2,6 @@ name: Security Audit
 
 on:
   schedule:
-    # Runs 6 times a day (every 4 hours: 00:00, 04:00, 08:00, 12:00, 16:00, 20:00 UTC)
     - cron: '0 */4 * * *'
   workflow_dispatch:
   push:
@@ -32,9 +31,12 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
 
+      - name: Refresh lockfile
+        run: npm install --package-lock-only --ignore-scripts --no-audit --no-fund
+
       - name: Install dependencies
         run: npm ci
 
@@ -64,7 +66,7 @@ jobs:
           title: "docs: Automated Security Audit Report Update"
           body: |
             This automated Pull Request updates the repository security audit reports in `security-reports/`.
-            
+
             Generated by the scheduled security check workflow.
           labels: |
             documentation
diff --git a/package.json b/package.json
index 97a60d6..5c472e4 100644
--- a/package.json
+++ b/package.json
@@ -61,7 +61,7 @@
     "date-fns": "3.6.0",
     "embla-carousel-react": "8.6.0",
     "firebase": "^12.15.0",
-    "firebase-admin": "^14.1.0",
+    "firebase-admin": "^14.2.0",
     "gsap": "^3.15.0",
     "input-otp": "1.4.2",
     "lenis": "^1.3.25",