diff --git a/action.yml b/action.yml
index 71ae614..8667d34 100644
--- a/action.yml
+++ b/action.yml
@@ -25,5 +25,5 @@ branding:
   icon: 'refresh-cw'
   color: 'blue'
 runs:
-  using: 'node20'
+  using: 'node24'
   main: 'packages/action/dist/index.js'
diff --git a/packages/action/dist/index.js b/packages/action/dist/index.js
index 7988690..a052b4e 100644
--- a/packages/action/dist/index.js
+++ b/packages/action/dist/index.js
@@ -1,3 +1,4 @@
+import { createRequire as __docmendCreateRequire } from 'module'; const require = __docmendCreateRequire(import.meta.url);
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
diff --git a/packages/action/package.json b/packages/action/package.json
index a3c74ff..2bbc45e 100644
--- a/packages/action/package.json
+++ b/packages/action/package.json
@@ -9,7 +9,7 @@
     "dist"
   ],
   "scripts": {
-    "build": "esbuild src/index.ts --bundle --platform=node --target=node20 --format=esm --external:@huggingface/transformers --outfile=dist/index.js && node scripts/copy-wasm.mjs",
+    "build": "node scripts/build.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
diff --git a/packages/action/scripts/build.mjs b/packages/action/scripts/build.mjs
new file mode 100644
index 0000000..720744e
--- /dev/null
+++ b/packages/action/scripts/build.mjs
@@ -0,0 +1,50 @@
+import { build } from 'esbuild';
+import { copyFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { basename, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// esbuild's ESM output has no real `require`, so its internal shim throws
+// whenever a bundled CJS dependency calls require() for something it can't
+// statically resolve (e.g. the `tunnel` package, pulled in transitively via
+// @actions/http-client's proxy support, does `require('net')` etc.). This
+// banner gives the bundle a genuine `require` to find - esbuild's own
+// documented fix for this exact class of error - so the output can stay ESM
+// (needed for import.meta.url, which @docmend/core's wasm-path resolution
+// depends on, and which esbuild empties out under CJS output instead).
+await build({
+  entryPoints: ['src/index.ts'],
+  bundle: true,
+  platform: 'node',
+  target: 'node24',
+  format: 'esm',
+  external: ['@huggingface/transformers'],
+  outfile: 'dist/index.js',
+  banner: {
+    // Aliased import: @docmend/core's grammar-loader.ts already imports
+    // createRequire under its own name, and gets bundled into this same
+    // module scope - importing it again under the unaliased name here
+    // would be a duplicate declaration (SyntaxError), not just a harmless
+    // redundant import.
+    js: "import { createRequire as __docmendCreateRequire } from 'module'; const require = __docmendCreateRequire(import.meta.url);",
+  },
+});
+
+// Resolved from @docmend/core's own location (not this script's) so it works
+// regardless of where npm happened to hoist these transitive dependencies.
+const coreEntry = fileURLToPath(import.meta.resolve('@docmend/core'));
+const coreRequire = createRequire(coreEntry);
+
+const wasmFiles = [
+  coreRequire.resolve('web-tree-sitter/tree-sitter.wasm'),
+  coreRequire.resolve('tree-sitter-wasms/out/tree-sitter-typescript.wasm'),
+  coreRequire.resolve('tree-sitter-wasms/out/tree-sitter-tsx.wasm'),
+  coreRequire.resolve('tree-sitter-wasms/out/tree-sitter-javascript.wasm'),
+  coreRequire.resolve('tree-sitter-wasms/out/tree-sitter-python.wasm'),
+];
+
+for (const file of wasmFiles) {
+  copyFileSync(file, join('dist', basename(file)));
+}
+
+console.log(`copied ${wasmFiles.length} wasm files into dist/`);
diff --git a/packages/action/scripts/copy-wasm.mjs b/packages/action/scripts/copy-wasm.mjs
deleted file mode 100644
index 58e348d..0000000
--- a/packages/action/scripts/copy-wasm.mjs
+++ /dev/null
@@ -1,23 +0,0 @@
-import { copyFileSync } from 'node:fs';
-import { createRequire } from 'node:module';
-import { basename, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-// Resolved from @docmend/core's own location (not this script's) so it works
-// regardless of where npm happened to hoist these transitive dependencies.
-const coreEntry = fileURLToPath(import.meta.resolve('@docmend/core'));
-const coreRequire = createRequire(coreEntry);
-
-const wasmFiles = [
-  coreRequire.resolve('web-tree-sitter/tree-sitter.wasm'),
-  coreRequire.resolve('tree-sitter-wasms/out/tree-sitter-typescript.wasm'),
-  coreRequire.resolve('tree-sitter-wasms/out/tree-sitter-tsx.wasm'),
-  coreRequire.resolve('tree-sitter-wasms/out/tree-sitter-javascript.wasm'),
-  coreRequire.resolve('tree-sitter-wasms/out/tree-sitter-python.wasm'),
-];
-
-for (const file of wasmFiles) {
-  copyFileSync(file, join('dist', basename(file)));
-}
-
-console.log(`copied ${wasmFiles.length} wasm files into dist/`);