diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1f2b156..ac96e23 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -531,7 +531,7 @@ jobs:
     # .tool-versions and asserted below, so a bump to one and not the other is a
     # named failure rather than a silent skew.
     container:
-      image: node:24.20.0-alpine
+      image: node:24.21.0-alpine
     defaults:
       run:
         shell: bash
diff --git a/.tool-versions b/.tool-versions
index f5f4dda..f6db94f 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1 +1 @@
-nodejs 24.20.0
+nodejs 24.21.0
diff --git a/package-lock.json b/package-lock.json
index eab70c3..8641a91 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,7 +8,7 @@
       "name": "clode",
       "version": "0.20260831.1",
       "engines": {
-        "node": "26.8.1"
+        "node": "26.8.2"
       }
     }
   }
diff --git a/package.json b/package.json
index fa359b0..45218e9 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,7 @@
   "private": true,
   "description": "Build a standalone Claude Code binary for any machine: clode repackages the upstream Claude Code bundle into a single executable, either a portable QuickJS/tjs binary (quaude) or a Node SEA (naude). clode contains no Anthropic code; you supply your own Claude Code and build locally.",
   "engines": {
-    "node": "26.8.1"
+    "node": "26.8.2"
   },
   "scripts": {
     "test": "node test/run.mjs",
diff --git a/spike/quickjs/qemu/docker-loop/Dockerfile.xfuse b/spike/quickjs/qemu/docker-loop/Dockerfile.xfuse
index 288e396..da8d1bc 100644
--- a/spike/quickjs/qemu/docker-loop/Dockerfile.xfuse
+++ b/spike/quickjs/qemu/docker-loop/Dockerfile.xfuse
@@ -4,7 +4,7 @@
 # BC_VERSION → cross-fuse compatible; (b) run `node scripts/stage0.mjs bootstrap`
 # with CLODE_TARGET_TEMPLATE=<sparc tjs> to append the trailer onto the sparc
 # base. node for the launcher; cmake/ninja/gcc for the tjs build.
-FROM node:24.20.0-bookworm-slim
+FROM node:24.21.0-bookworm-slim
 
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \