diff --git a/.github/workflows/npm-audit-signatures.yml b/.github/workflows/npm-audit-signatures.yml
new file mode 100644
index 000000000..8d75dc332
--- /dev/null
+++ b/.github/workflows/npm-audit-signatures.yml
@@ -0,0 +1,29 @@
+name: NPM Audit Signatures
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'package.json'
+      - 'package-lock.json'
+  pull_request:
+    paths:
+      - 'package.json'
+      - 'package-lock.json'
+
+permissions:
+  contents: read
+
+jobs:
+  audit-signatures:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .tool-versions
+
+      - run: npm ci --ignore-scripts
+      - run: npm audit signatures --min-release-age=0
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 000000000..5b685d797
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,2 @@
+; npm 11+ required: npm 10 silently ignores min-release-age
+min-release-age=3
diff --git a/.tool-versions b/.tool-versions
index a3128f26b..12376e4f0 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1 +1 @@
-nodejs 22.22.0
+nodejs 24.19.0
diff --git a/package-lock.json b/package-lock.json
index eea44a42d..2e838f029 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -56,7 +56,8 @@
         "typescript": "^6.0.3"
       },
       "engines": {
-        "node": ">=22.18.0"
+        "node": ">=22.18.0",
+        "npm": ">=11 <12"
       }
     },
     "node_modules/@11ty/gray-matter": {
@@ -14894,37 +14895,6 @@
         "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/hast-util-to-estree/node_modules/unist-util-visit": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-4.1.2.tgz",
-      "integrity": "sha512-MSd8OUGISqHdVvfY9TPhyK2VdUrPgxkUtWSuMHF6XAAFuL4LokseigBnZtPnJMu+FbynTkFNnFlyjxpVKujMRg==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "unist-util-is": "^5.0.0",
-        "unist-util-visit-parents": "^5.1.1"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/hast-util-to-estree/node_modules/unist-util-visit-parents": {
-      "version": "5.1.3",
-      "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-5.1.3.tgz",
-      "integrity": "sha512-x6+y8g7wWMyQhL1iZfhIPhDAs7Xwbn9nRosDXl7qoPTSCy0yNxnKc+hWokFifWQIDGi154rdUqKvbCa4+1kLhg==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "unist-util-is": "^5.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
     "node_modules/hast-util-to-jsx-runtime": {
       "version": "2.3.6",
       "resolved": "https://registry.npmjs.org/hast-util-to-jsx-runtime/-/hast-util-to-jsx-runtime-2.3.6.tgz",
diff --git a/package.json b/package.json
index 72c6cd3f6..51dfc6ded 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,8 @@
   "license": "Creative Commons Attribution-NonCommercial 4.0 International",
   "private": true,
   "engines": {
-    "node": ">=22.18.0"
+    "node": ">=24.0.0",
+    "npm": ">=11 <12"
   },
   "scripts": {
     "docusaurus": "docusaurus",