diff --git a/tsup.config.ts b/tsup.config.ts
index 8d247f4..e3f2f9f 100644
--- a/tsup.config.ts
+++ b/tsup.config.ts
@@ -34,4 +34,16 @@ export default defineConfig({
   // runtime, so every npm dependency (AWS SDK, @actions/core, @octokit/…) must
   // be bundled in. Node.js built-ins stay external automatically (platform:'node').
   noExternal: [/.*/],
+  // CJS packages bundled into ESM (e.g. tunnel@0.0.6 via @actions/http-client)
+  // call require('net') / require('tls') at runtime. esbuild's __require shim
+  // checks `typeof require !== "undefined"` — which is false in pure ESM — and
+  // throws "Dynamic require of 'net' is not supported". Injecting createRequire
+  // as a top-level banner supplies a real require() before the shim runs,
+  // so those CJS modules can load Node.js built-ins normally.
+  // NOTE: this banner uses import/import.meta.url — only valid in ESM output.
+  // If format is ever extended to include 'cjs', this must be conditioned or
+  // moved to a format-specific banner ({ esm: '...' }) to avoid a parse error.
+  banner: {
+    js: "import { createRequire } from 'node:module'; var require = createRequire(import.meta.url);",
+  },
 });