diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 4351d4f47e7..04d2e70fe95 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -33,7 +33,10 @@ jobs:
             contents: read
         strategy:
             matrix:
-                node: ['26', '25', '24', '22']
+                # Pinned to 26.7: Node 26.8.0 rewrote fs.readFile
+                # (nodejs/node#65327) so that binding.open is no longer called
+                # from JS, which breaks mock-fs at require time
+                node: ['26.7', '25', '24', '22']
         name: Node ${{ matrix.node }} validation
         steps:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/package-lock.json b/package-lock.json
index ef6900bca60..5a3db25ffcc 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1902,9 +1902,9 @@
             }
         },
         "node_modules/openid-client": {
-            "version": "6.8.6",
-            "resolved": "https://registry.npmjs.org/openid-client/-/openid-client-6.8.6.tgz",
-            "integrity": "sha512-lsfMRH/GCgMiGCRnBRY3e70uogkgOessPaTOhP3rw/dxqNOZHwOazWx+m6jt5EVk3ecRFULl0TwWpk9Qnw3RKQ==",
+            "version": "6.8.7",
+            "resolved": "https://registry.npmjs.org/openid-client/-/openid-client-6.8.7.tgz",
+            "integrity": "sha512-gtKthNu7evSBvTdrrlHb4F3Fi9dcwlb5QaITlCs+9mfpvuOi0Q3qtBf5+iY4sEP8hy1qCoAdxBNPDcmZeVSDzQ==",
             "license": "MIT",
             "dependencies": {
                 "jose": "^6.2.8",