diff --git a/.github/workflows/gateway-msix.yml b/.github/workflows/gateway-msix.yml
index 7c58ef13..6c48df98 100644
--- a/.github/workflows/gateway-msix.yml
+++ b/.github/workflows/gateway-msix.yml
@@ -26,8 +26,8 @@ permissions:
   contents: read
 
 env:
-  NODE_VERSION: 24.16.0
-  PNPM_VERSION: 11.15.1
+  NODE_VERSION: 24.20.0
+  PNPM_VERSION: 11.24.0
   OPENCLAW_REF: ${{ github.event_name == 'workflow_dispatch' && inputs.openclaw_ref || '0790d9f593ad30c940ed93b5872a8cf6d6f3cf8c' }}
   PACKAGING_ROOT: .
 
@@ -65,6 +65,10 @@ jobs:
   build-package:
     name: Build OpenClaw npm package
     runs-on: ubuntu-latest
+    env:
+      # The packaging toolchain owns pnpm, including inside upstream scripts.
+      COREPACK_ENABLE_PROJECT_SPEC: "0"
+      pnpm_config_pm_on_fail: ignore
     outputs:
       source_sha: ${{ steps.source.outputs.sha }}
       package_version: ${{ steps.source.outputs.version }}
@@ -79,7 +83,7 @@ jobs:
           fetch-depth: 1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -90,7 +94,9 @@ jobs:
 
       - name: Install dependencies
         working-directory: openclaw-source
-        run: pnpm install --frozen-lockfile
+        run: |
+          test "$(pnpm --version)" = "${PNPM_VERSION}"
+          pnpm install --frozen-lockfile
 
       - name: Build OpenClaw
         working-directory: openclaw-source
@@ -153,7 +159,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -235,6 +241,19 @@ jobs:
             -SourceCommit '${{ github.sha }}' `
             -OutputDirectory '${{ runner.temp }}\openclaw-msix'
 
+      - name: Smoke-test packaged x64 launcher
+        if: matrix.architecture == 'x64'
+        shell: pwsh
+        run: |
+          $package = '${{ runner.temp }}\openclaw-msix\OpenClawGateway-x64.msix'
+          $unpacked = '${{ runner.temp }}\openclaw-msix-smoke'
+          [IO.Compression.ZipFile]::ExtractToDirectory($package, $unpacked)
+          & (Join-Path $unpacked 'openclaw.exe') --version
+          if ($LASTEXITCODE -ne 0) {
+            throw "Packaged launcher smoke test failed with exit code $LASTEXITCODE."
+          }
+          Write-Host 'Packaged launcher smoke test passed.'
+
       - name: Upload unsigned MSIX
         uses: actions/upload-artifact@v7
         with:
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 00000000..7b414019
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,5 @@
+# Changelog
+
+## Unreleased
+
+- Update the bundled Node.js runtime from 24.16.0 to 24.20.0 LTS for x64 and ARM64 packages.
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 05461f42..9b4f89f2 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -7,10 +7,10 @@
 
   <ItemGroup>
     <PackageVersion Include="Microsoft.WindowsAppSDK.Base" Version="2.0.4" />
-    <PackageVersion Include="Microsoft.Windows.SDK.BuildTools" Version="10.0.26100.4948" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.6.0" />
+    <PackageVersion Include="Microsoft.Windows.SDK.BuildTools" Version="10.0.28000.2705" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
     <PackageVersion Include="xunit" Version="2.9.3" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="4.0.0" />
   </ItemGroup>
 
 </Project>
diff --git a/README.md b/README.md
index 29cbe136..152da1ae 100644
--- a/README.md
+++ b/README.md
@@ -8,6 +8,9 @@ This repository builds a Windows MSIX package containing:
   [`openclaw/openclaw`](https://github.com/openclaw/openclaw);
 - the matching official Node.js runtime for x64 or ARM64.
 
+Builds use .NET SDK 10.0.400 or a later .NET 10 feature band and bundle
+Node.js 24.20.0 LTS for both architectures.
+
 The package is independent from the OpenClaw Companion application and uses a
 separate `OpenClaw.Gateway` package identity. Both packages use the OpenClaw
 Foundation publisher metadata established for OpenClaw's Windows packages.
diff --git a/global.json b/global.json
index 512142d2..01cb6588 100644
--- a/global.json
+++ b/global.json
@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "10.0.100",
+    "version": "10.0.400",
     "rollForward": "latestFeature"
   }
 }
diff --git a/scripts/Build-LocalMSIX.ps1 b/scripts/Build-LocalMSIX.ps1
index 906fab39..cb2bab29 100644
--- a/scripts/Build-LocalMSIX.ps1
+++ b/scripts/Build-LocalMSIX.ps1
@@ -137,7 +137,7 @@ try {
     & .\scripts\Build-MSIX.ps1 `
         -PayloadDirectory $resolvedPayloadDirectory `
         -Architecture $Architecture `
-        -NodeVersion 24.16.0 `
+        -NodeVersion 24.20.0 `
         -PackageVersion $PackageVersion `
         -SourceCommit $sourceCommit `
         -SourceTreeDirty:$sourceTreeDirty `