diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 77d28144..c319b8b0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -211,8 +211,17 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: '0'
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24.21.0"
+
+      # setup-node ships the npm bundled with Node 24 (11.x). npm 12 is the first
+      # version that blocks dependency install scripts, so pin it before installing.
       - name: Install Dependencies
-        run: npm install -g semver
+        run: |
+          npm install -g --ignore-scripts npm@12.1.0
+          npm install -g semver
 
       - name: Setup Bats
         id: setup-bats
diff --git a/Dockerfile b/Dockerfile
index 0e5cf06f..234630a1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,9 +1,13 @@
-FROM node:20-alpine
+FROM node:24.21.0-alpine
 LABEL "repository"="https://github.com/anothrNick/github-tag-action"
 LABEL "homepage"="https://github.com/anothrNick/github-tag-action"
 LABEL "maintainer"="Nick Sjostrom"
 
-RUN apk --no-cache add bash git git-lfs curl jq && npm install -g semver
+# node:24.21.0 ships npm 11. npm 12 is the first version that blocks dependency
+# install scripts, so pin it before installing semver.
+RUN apk --no-cache add bash git git-lfs curl jq \
+  && npm install -g --ignore-scripts npm@12.1.0 \
+  && npm install -g semver
 
 COPY entrypoint.sh /entrypoint.sh