diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index e744794..09406f0 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -81,6 +81,10 @@ jobs:
             echo "workflows must use node-version-file, not a literal version"
             bad=1
           fi
+          if grep -rnE 'node:[0-9][^ ]*-alpine' .gitea/workflows | grep -v "node:${ver}-alpine"; then
+            echo "a workflow references a different node image than node:${ver}-alpine"
+            bad=1
+          fi
           if ! grep -q "\"node\": \">=${ver}\"" package.json; then
             echo "package.json engines floor does not match ${ver}"
             bad=1
diff --git a/.gitea/workflows/drill.yml b/.gitea/workflows/drill.yml
index 9278d43..bc8272e 100644
--- a/.gitea/workflows/drill.yml
+++ b/.gitea/workflows/drill.yml
@@ -55,7 +55,7 @@ jobs:
           } > comment.md
           # JSON-encode via a node container — the runner image guarantees
           # only git/curl/docker, not python or node.
-          docker run --rm -i node:22.15-alpine node -e \
+          docker run --rm -i node:22.15.1-alpine node -e \
             'const fs=require("fs");process.stdout.write(JSON.stringify({body:fs.readFileSync(0,"utf8")}))' \
             < comment.md > comment.json
           curl -sf -X POST \
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 3aec54d..0f32860 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -54,7 +54,7 @@ jobs:
               echo '_No database migrations in this release._'
             fi
           } > notes.md
-          TAG=$TAG docker run --rm -i -e TAG node:22.15-alpine node -e \
+          TAG=$TAG docker run --rm -i -e TAG node:22.15.1-alpine node -e \
             'const fs=require("fs");const body=fs.readFileSync(0,"utf8");process.stdout.write(JSON.stringify({tag_name:process.env.TAG,name:process.env.TAG,body}))' \
             < notes.md > release.json
           curl -sf -X POST \