diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3cd3d19..73b7837 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -130,7 +130,7 @@ jobs:
           echo "platform_target=$platform_target" >> "$GITHUB_OUTPUT"
           echo "content_target=$content_target" >> "$GITHUB_OUTPUT"
       - name: Log in to GHCR
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -263,7 +263,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Log in to GHCR
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.node-version b/.node-version
index 3eb1386..60ade1a 100644
--- a/.node-version
+++ b/.node-version
@@ -1 +1 @@
-26.5.0
+24.19.0
diff --git a/README.md b/README.md
index 619a952..ab297a6 100644
--- a/README.md
+++ b/README.md
@@ -137,7 +137,7 @@ NFS and SMB are not supported. Do not run two ImageSilo containers against the s
 ### Prerequisites
 
 - Go 1.26.5
-- Node.js 26.5.0
+- Node.js 24.19.0
 - npm
 
 ### Build and Verify
diff --git a/README.zh.md b/README.zh.md
index 46cf26c..f49971b 100644
--- a/README.zh.md
+++ b/README.zh.md
@@ -137,7 +137,7 @@ docker compose exec imagesilo sh -c \
 ### 前置依赖
 
 - Go 1.26.5
-- Node.js 26.5.0
+- Node.js 24.19.0
 - npm
 
 ### 构建与验证
diff --git a/deploy/docker/Dockerfile b/deploy/docker/Dockerfile
index 4c24599..ba7704d 100644
--- a/deploy/docker/Dockerfile
+++ b/deploy/docker/Dockerfile
@@ -1,5 +1,5 @@
-ARG NODE_IMAGE=node:26.5.0-bookworm-slim@sha256:2d49d876e96237d76de412761cf05dbfe5aee325cc4406a4d41d5824c5bb8beb
-ARG GO_IMAGE=golang:1.26.5-bookworm@sha256:1ecb7edf62a0408027bd5729dfd6b1b8766e578e8df93995b225dfd0944eb651
+ARG NODE_IMAGE=node:24.19.0-bookworm-slim@sha256:3638d9a6fe4030bd716be989438248074489337ba3275657f93595428be4fc03
+ARG GO_IMAGE=golang:1.26.5-bookworm@sha256:6c5605ab3a9a9fb3c4eafe5b3d63cdbf3881caf113262b67862547b54a9db599
 ARG RUNTIME_IMAGE=debian:bookworm-slim@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818
 ARG VIPS_VERSION=8.18.4
 ARG VIPS_SHA256=2677bad6c422617fd1172d359c16af34e736965d042c214203a87187d26ff037
diff --git a/docs/ci.md b/docs/ci.md
index 14d1c62..48bb222 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -7,6 +7,9 @@
 - `actions/checkout` 7.0.1
 - `actions/setup-go` 7.0.0
 - `actions/setup-node` 7.0.0
+- `docker/login-action` 4.6.0（仅 Release）
+
+以上 JavaScript Actions 均声明使用 Node.js 24 runtime。`actions/setup-node` 再从 `.node-version` 安装精确的 Node.js 24.19.0；Go 工具链由 `.go-version` 固定为 1.26.5。
 
 唯一的 `quality` job 执行 `make check e2e`，覆盖 Go、React、OpenAPI 生成一致性、Lint、类型检查、单元/集成测试和单 worker 浏览器闭环。该工作流不构建容器镜像、不运行容器 smoke，也不接触 GHCR；`quality` check 名称保持不变。
 
diff --git a/docs/dependencies.md b/docs/dependencies.md
index 15c1d3e..7438feb 100644
--- a/docs/dependencies.md
+++ b/docs/dependencies.md
@@ -1,13 +1,13 @@
 # 依赖版本基线
 
-解析日期：2026-07-29。全部版本排除了 alpha、beta、RC、preview 和 nightly；直接依赖使用精确版本，前端完整依赖树由 `package-lock.json` 锁定。
+依赖解析基线日期：2026-07-29；工具链与基础镜像复核日期：2026-08-06。全部版本排除了 alpha、beta、RC、preview 和 nightly；直接依赖使用精确版本，前端完整依赖树由 `package-lock.json` 锁定。
 
 ## 工具链与原生组件
 
 | 组件 | 精确版本 | 官方来源 |
 |---|---:|---|
 | Go | 1.26.5 | `https://go.dev/dl/` |
-| Node.js | 26.5.0 | `https://nodejs.org/dist/` |
+| Node.js | 24.19.0 | `https://nodejs.org/dist/` |
 | TypeScript | 5.9.3 | `https://registry.npmjs.org/typescript/5.9.3` |
 | SQLite | 3.53.4 | `https://www.sqlite.org/download.html` |
 | libvips | 8.18.4 | `https://github.com/libvips/libvips/releases/tag/v8.18.4` |
@@ -42,8 +42,8 @@ React Router 7.18.2 在解析日命中 `GHSA-qwww-vcr4-c8h2`。GitHub 官方公
 
 | 用途 | 镜像 | Digest |
 |---|---|---|
-| Go 构建 | `golang:1.26.5-bookworm` | `sha256:1ecb7edf62a0408027bd5729dfd6b1b8766e578e8df93995b225dfd0944eb651` |
-| Node 构建 | `node:26.5.0-bookworm-slim` | `sha256:2d49d876e96237d76de412761cf05dbfe5aee325cc4406a4d41d5824c5bb8beb` |
+| Go 构建 | `golang:1.26.5-bookworm` | `sha256:6c5605ab3a9a9fb3c4eafe5b3d63cdbf3881caf113262b67862547b54a9db599` |
+| Node 构建 | `node:24.19.0-bookworm-slim` | `sha256:3638d9a6fe4030bd716be989438248074489337ba3275657f93595428be4fc03` |
 | 运行时 | `debian:bookworm-slim` | `sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818` |
 
 这些 digest 在依赖升级时重新解析，并重新执行 amd64/arm64 构建与 smoke test。
diff --git a/docs/security-audit.md b/docs/security-audit.md
index 1445bec..87ecf84 100644
--- a/docs/security-audit.md
+++ b/docs/security-audit.md
@@ -61,4 +61,4 @@
 
 公开 OCI manifest 为 `sha256:573233d00455ab6e8dad9d875ad0ede7f770436ce24bb05f6d21bc02fac053cc`；amd64 子 manifest 为 `sha256:ee410a57912c125234e5547520a1f5b38a253649cfeec88aec34d53903838ad8`，arm64 子 manifest 为 `sha256:a5437e2348e74a9aaa53e0ac7f685c379153d9183362651e1a88a077f9f9452d`。独立匿名 GHCR token 请求返回 HTTP 200，证明无需仓库或包权限即可拉取。
 
-本次唯一非阻断注记是固定版本 `docker/login-action` 仍声明 Node.js 20，GitHub Runner 已自动强制使用 Node.js 24；不影响镜像内容或运行时资源边界，后续依赖维护时升级其已审计 commit pin。
+2026-08-06 复核已将 `docker/login-action` 升级到声明 Node.js 24 runtime 的 4.6.0，并继续固定到已验证的完整 commit SHA。仓库内 `actions/checkout`、`actions/setup-go`、`actions/setup-node` 和 `docker/login-action` 的当前 pin 均声明 `node24`，原 Node.js 20 弃用提示已从配置源消除。
diff --git a/web/package-lock.json b/web/package-lock.json
index 0844bfd..87d8ad5 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -29,7 +29,7 @@
         "@tailwindcss/vite": "4.3.3",
         "@testing-library/jest-dom": "7.0.0",
         "@testing-library/react": "16.3.2",
-        "@types/node": "26.1.2",
+        "@types/node": "24.13.3",
         "@types/react": "19.2.17",
         "@types/react-dom": "19.2.3",
         "@vitejs/plugin-react": "6.0.4",
@@ -44,6 +44,9 @@
         "typescript-eslint": "8.65.0",
         "vite": "8.1.5",
         "vitest": "4.1.10"
+      },
+      "engines": {
+        "node": "24.x"
       }
     },
     "node_modules/@adobe/css-tools": {
@@ -2256,13 +2259,13 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "26.1.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.2.tgz",
-      "integrity": "sha512-Vu4a5UFA9rIIFJ7rB/Vaafh9lrCQszopTCx6KjFboXTGQbPNasehVR5TEiithSDGyd1DEiUByggTZsg8jukeIg==",
+      "version": "24.13.3",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
+      "integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "undici-types": "~8.3.0"
+        "undici-types": "~7.18.0"
       }
     },
     "node_modules/@types/react": {
@@ -5101,9 +5104,9 @@
       }
     },
     "node_modules/undici-types": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
-      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
+      "version": "7.18.2",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
+      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
       "dev": true,
       "license": "MIT"
     },
diff --git a/web/package.json b/web/package.json
index f8abd24..e5b6185 100644
--- a/web/package.json
+++ b/web/package.json
@@ -3,6 +3,9 @@
   "version": "0.0.0",
   "private": true,
   "type": "module",
+  "engines": {
+    "node": "24.x"
+  },
   "scripts": {
     "dev": "vite",
     "build": "tsc -b && vite build",
@@ -34,7 +37,7 @@
     "@tailwindcss/vite": "4.3.3",
     "@testing-library/jest-dom": "7.0.0",
     "@testing-library/react": "16.3.2",
-    "@types/node": "26.1.2",
+    "@types/node": "24.13.3",
     "@types/react": "19.2.17",
     "@types/react-dom": "19.2.3",
     "@vitejs/plugin-react": "6.0.4",