diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index ffdbe061..78348ffe 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -15,13 +15,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-      
-      - uses: pnpm/action-setup@v4
+      # Toolchains come from mise.toml, read here by mise-action so the runner
+      # and a developer's shell resolve identical versions.
+      - name: Setup toolchains (mise)
+        uses: jdx/mise-action@v4
 
+      - uses: pnpm/action-setup@v4
 
       - name: Install dependencies
         run: pnpm install
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 20911e18..618da4f7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,12 +26,21 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
 
-      - name: Setup node.js
-        uses: actions/setup-node@v4
+      # Toolchains come from mise.toml, read here by mise-action so the runner
+      # and a developer's shell resolve identical versions.
+      - name: Setup toolchains (mise)
+        uses: jdx/mise-action@v4
+
+      - name: Locate pnpm store
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
+
+      - name: Cache pnpm store
+        uses: actions/cache@v4
         with:
-          node-version: 22
-          cache: 'pnpm'
-      
+          path: ${{ env.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: ${{ runner.os }}-pnpm-store-
+
       - name: Install dependencies
         run: pnpm install
       
diff --git a/mise.toml b/mise.toml
new file mode 100644
index 00000000..4d5d00ac
--- /dev/null
+++ b/mise.toml
@@ -0,0 +1,11 @@
+# Toolchain versions for this repo — read by mise locally and by
+# jdx/mise-action in CI, so a developer's shell and the runner agree.
+#
+# Not listed here on purpose:
+#   pnpm  -> package.json "packageManager". pnpm self-substitutes to that
+#            version regardless of which pnpm binary launches it, so a mise
+#            pin would be cosmetic and would drift.
+#   rust  -> rust-toolchain.toml + dtolnay/rust-toolchain. rustup is canonical
+#            and mise defers to it anyway.
+[tools]
+node = "24.14.0"  # ships npm 11.9.0 — required (>=11.5.1) for npm OIDC trusted publishing
diff --git a/package.json b/package.json
index 363d071f..e845b731 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "peerDependencies": {
         "typescript": "^5.8.2"
     },
-    "packageManager": "pnpm@10.6.1+sha512.40ee09af407fa9fbb5fbfb8e1cb40fbb74c0af0c3e10e9224d7b53c7658528615b2c92450e74cfad91e3a2dcafe3ce4050d80bda71d757756d2ce2b66213e9a3",
+    "packageManager": "pnpm@10.34.5",
     "engines": {
         "node": ">=20.0.0"
     },