diff --git a/.github/workflows/js_tests.yml b/.github/workflows/js_tests.yml
index 43eb551b..31dac8c4 100644
--- a/.github/workflows/js_tests.yml
+++ b/.github/workflows/js_tests.yml
@@ -27,16 +27,23 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Parse .tool-versions
+        uses: wistia/parse-tool-versions@v2.1.1
+        with:
+          filename: '.tool-versions'
+          uppercase: 'true'
+          prefix: 'tool_version_'
+
       - name: Install pnpm
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@v4
         id: pnpm-install
         with:
-          version: 9.5
+          version: ${{ env.TOOL_VERSION_PNPM }}
 
       - name: Setup Node
         uses: actions/setup-node@v3
         with:
-          node-version: "20.x"
+          node-version: '${{ env.TOOL_VERSION_NODE }}'
           registry-url: "https://registry.npmjs.org"
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
@@ -62,7 +69,7 @@ jobs:
       - name: Install Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.14
+          bun-version: ${{ env.TOOL_VERSION_BUN }}
 
       - name: Run Bun tests
         run: pnpm test:bun
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 08beb345..99e83c9f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -24,12 +24,12 @@ jobs:
 
       - uses: pnpm/action-setup@v4
         with:
-          version: 9.15.9
+          version: ${{ env.TOOL_VERSION_PNPM }}
 
       - name: Setup Node.js 20
         uses: actions/setup-node@v4
         with:
-          node-version: '20.x'
+          node-version: '${{ env.TOOL_VERSION_NODE }}'
           cache: pnpm
 
       - name: Configure pnpm
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 84b5d3a6..c54b94ff 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,16 +21,23 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v4
 
+      - name: Parse .tool-versions
+        uses: wistia/parse-tool-versions@v2.1.1
+        with:
+          filename: '.tool-versions'
+          uppercase: 'true'
+          prefix: 'tool_version_'
+
       - name: Install pnpm
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@v4
         id: pnpm-install
         with:
-          version: 9.5
+          version: ${{ env.TOOL_VERSION_PNPM }}
 
       - name: Setup Node
         uses: actions/setup-node@v6
         with:
-          node-version: "22.x"
+          node-version: '${{ env.TOOL_VERSION_NODE }}'
           registry-url: "https://registry.npmjs.org"
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
@@ -63,16 +70,23 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v4
 
+      - name: Parse .tool-versions
+        uses: wistia/parse-tool-versions@v2.1.1
+        with:
+          filename: '.tool-versions'
+          uppercase: 'true'
+          prefix: 'tool_version_'
+
       - name: Install pnpm
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@v4
         id: pnpm-install
         with:
-          version: 9.5
+          version: ${{ env.TOOL_VERSION_PNPM }}
 
       - name: Setup Node
         uses: actions/setup-node@v6
         with:
-          node-version: "22.x"
+          node-version: '${{ env.TOOL_VERSION_NODE }}'
           registry-url: "https://registry.npmjs.org"
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
@@ -128,10 +142,10 @@ jobs:
           prefix: 'tool_version_'
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@v4
         id: pnpm-install
         with:
-          version: 9.5
+          version: ${{ env.TOOL_VERSION_PNPM }}
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -327,9 +341,9 @@ jobs:
           virtualenvs-in-project: true
           installer-parallel: true
 
-      - uses: pnpm/action-setup@v3
+      - uses: pnpm/action-setup@v4
         with:
-          version: 9.5
+          version: ${{ env.TOOL_VERSION_PNPM }}
 
       - name: Setup Node.js 24
         uses: actions/setup-node@v6
diff --git a/.github/workflows/release_candidates.yml b/.github/workflows/release_candidates.yml
index cd09fce4..389fd15c 100644
--- a/.github/workflows/release_candidates.yml
+++ b/.github/workflows/release_candidates.yml
@@ -24,16 +24,16 @@ jobs:
           uppercase: 'true'
           prefix: 'tool_version_'
 
-      - uses: pnpm/action-setup@v3
+      - uses: pnpm/action-setup@v4
         if: ${{ contains( github.event.pull_request.labels.*.name, 'js-rc') }}
         with:
-          version: 9.5
+          version: ${{ env.TOOL_VERSION_PNPM }}
 
       - name: Setup Node.js 20
         uses: actions/setup-node@v4
         if: ${{ contains( github.event.pull_request.labels.*.name, 'js-rc') }}
         with:
-          node-version: "20.x"
+          node-version: '${{ env.TOOL_VERSION_NODE }}'
           registry-url: https://registry.npmjs.org
           cache: pnpm
 
diff --git a/.tool-versions b/.tool-versions
index 0c2d9665..2c1a9b66 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,2 +1,11 @@
 python 3.10
 poetry 2.1.1
+# Keep in sync with `packageManager` in package.json, js/package.json and
+# python/package.json — pnpm self-switches to that version at runtime.
+pnpm 10.34.5
+# Baseline Node for build/test/lint. Matches the `engines.node` floor in
+# js/package.json, so CI exercises the oldest version the SDK claims to support.
+# The release job in release.yml deliberately overrides this with Node 24 to get
+# npm 11 for OIDC trusted publishing (see #259).
+node 20
+bun 1.3.14
diff --git a/js/package.json b/js/package.json
index 19835c5c..158da8e5 100644
--- a/js/package.json
+++ b/js/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@e2b/code-interpreter",
   "version": "2.7.0",
-  "packageManager": "pnpm@9.15.9",
+  "packageManager": "pnpm@10.34.5",
   "description": "E2B Code Interpreter - Stateful code execution",
   "homepage": "https://e2b.dev",
   "license": "MIT",
diff --git a/package.json b/package.json
index 36f628e8..bd07e54b 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,7 @@
     "format": "pnpm --if-present --recursive run format",
     "changeset": "pnpx @changesets/cli"
   },
-  "packageManager": "pnpm@9.15.9",
+  "packageManager": "pnpm@10.34.5",
   "devDependencies": {
     "@changesets/read": "^0.6.2",
     "changeset": "^0.2.6",
@@ -21,7 +21,7 @@
     "prettier": "^3.6.2"
   },
   "engines": {
-    "pnpm": ">=9.0.0 <10"
+    "pnpm": ">=10.16.0 <11"
   },
   "pnpm": {
     "overrides": {
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 57e95728..59b88ef5 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -3,3 +3,15 @@ packages:
   - python
   - chart_data_extractor
   - template
+
+# Only install package versions that have been on the registry for at least
+# 3 days, so malicious releases have time to be caught and unpublished.
+minimumReleaseAge: 4320
+
+# `e2b` is our own SDK — we control its releases, so it doesn't need the delay.
+minimumReleaseAgeExclude:
+  - e2b
+
+# pnpm 10 blocks dependency lifecycle scripts unless listed here.
+onlyBuiltDependencies:
+  - esbuild
diff --git a/python/package.json b/python/package.json
index 05a6ec7d..bd0e5fef 100644
--- a/python/package.json
+++ b/python/package.json
@@ -2,7 +2,7 @@
   "name": "@e2b/code-interpreter-python",
   "private": true,
   "version": "2.9.0",
-  "packageManager": "pnpm@9.15.9",
+  "packageManager": "pnpm@10.34.5",
   "scripts": {
     "test": "poetry run pytest -n 4 --verbose -x",
     "example": "poetry run python3 example.py",
diff --git a/renovate.json5 b/renovate.json5
index 616f7b69..57cf90fb 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -9,10 +9,19 @@
   //    "0 * * * *"
   //  ],
   timezone: 'UTC',
+  // Keep in sync with `minimumReleaseAge` in pnpm-workspace.yaml (4320 minutes),
+  // otherwise Renovate proposes versions pnpm then refuses to install.
+  minimumReleaseAge: '3 days',
   // Always squash PRs when automerging
   automergeType: 'pr',
   automergeStrategy: 'squash',
   packageRules: [
+    {
+      // Keep in sync with `minimumReleaseAgeExclude` in pnpm-workspace.yaml.
+      description: 'e2b is our own SDK, so it skips the minimum release age',
+      matchPackageNames: ['e2b'],
+      minimumReleaseAge: null,
+    },
     {
       description: 'Group and automerge patch updates after CI passes',
       matchUpdateTypes: ['patch'],