diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index d99b140..a487f4b 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -20,15 +20,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Populate design system submodule
         run: git submodule update --init
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
 
       - name: Install dependencies
@@ -53,11 +53,14 @@ jobs:
         run: npx playwright install chromium --with-deps
 
       - name: Start app server
-        # No Octavus credentials in CI — audit.mjs stubs /api/* when A11Y_CI=1.
-        # A placeholder AGENT_ID keeps the server from warning; the stub never
-        # reaches the create-session path.
+        # No real Octavus credentials in CI — audit.mjs stubs /api/* when
+        # A11Y_CI=1. Placeholders only satisfy OctavusClient construction so
+        # the static app can serve; the stub never reaches create-session.
         run: |
-          PORT=3100 AGENT_TARGET=dev OCTAVUS_AGENT_ID=ci-placeholder \
+          PORT=3100 AGENT_TARGET=dev \
+            OCTAVUS_API_URL=https://ci.placeholder \
+            OCTAVUS_API_KEY=ci-placeholder \
+            OCTAVUS_AGENT_ID=ci-placeholder \
             node server.js > /tmp/chatcpt-ci-server.log 2>&1 &
           echo $! > /tmp/chatcpt-ci-server.pid
           for i in $(seq 1 30); do
@@ -83,7 +86,7 @@ jobs:
 
       - name: Upload axe report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: axe-report
           path: a11y-audits/tools/a11y-out-ci/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 717e4be..1139c82 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,15 +13,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Populate design system submodule
         run: git submodule update --init
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
 
       - name: Install dependencies
@@ -42,7 +42,7 @@ jobs:
           mv /tmp/dist.tar.gz dist.tar.gz
 
       - name: Upload build artifact (for workflow logs)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist.tar.gz