diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 211a2d5..cddb057 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,14 +36,14 @@ jobs:
       fail-fast: false
       matrix:
         node:
-          - 22
-          - 24
+          - "22.23.4"
+          - "24.22.1"
         os:
           - ubuntu-latest
           - xcode-27
           - windows-latest
         include:
-          - node: 26
+          - node: "26.12.1"
             os: ubuntu-latest
     steps:
       - name: Check out
@@ -69,7 +69,7 @@ jobs:
         run: pnpm check
 
       - name: Report coverage
-        if: matrix.node == 24 && matrix.os == 'ubuntu-latest'
+        if: matrix.node == '24.22.1' && matrix.os == 'ubuntu-latest'
         run: pnpm test:coverage
 
   browser-smoke:
@@ -89,7 +89,7 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 24
+          node-version: 24.22.1
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9ca4381..deabfe3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  NODE_VERSION: 24
+  NODE_VERSION: 24.22.1
 
 jobs:
   publish:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3abe73d..d17fc44 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,8 @@ All notable changes to `@openclaw/libterminal` will be documented in this file.
 
 ### Changed
 
+- Use fixed Node.js patches for build, CI, and release tooling to reject the disclosed eMudhra incident keys.
+
 - Update Vitest and its V8 coverage provider to 5.0.5 and the paired CodeQL actions to 4.39.0, preserving supported runtimes and the dependency cooldown. (#112, #113, thanks @dependabot[bot])
 - Run macOS CI on the Apple Silicon Xcode 27 image while preserving the supported Node.js versions and package targets.