diff --git a/.node-version b/.node-version
new file mode 100644
index 00000000000..2bd5a0a98a3
--- /dev/null
+++ b/.node-version
@@ -0,0 +1 @@
+22
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 00000000000..2bd5a0a98a3
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+22
diff --git a/crates/ironclaw_webui_v2_static/build.rs b/crates/ironclaw_webui_v2_static/build.rs
index 02b3e5ca85d..cf18b3138b8 100644
--- a/crates/ironclaw_webui_v2_static/build.rs
+++ b/crates/ironclaw_webui_v2_static/build.rs
@@ -81,6 +81,7 @@ fn collect(root: &Path, dir: &Path, out: &mut Vec<(String, PathBuf)>) {
             {
                 continue;
             }
+            println!("cargo:rerun-if-changed={}", path.display());
             let rel = path.strip_prefix(root).expect("strip prefix"); // safety: build script — strip_prefix only fails on a logic bug
             // Force forward slashes in the URL key even on Windows hosts.
             let url = rel
diff --git a/crates/ironclaw_webui_v2_static/frontend/package-lock.json b/crates/ironclaw_webui_v2_static/frontend/package-lock.json
index 720f52fb292..9c1bbc0b23d 100644
--- a/crates/ironclaw_webui_v2_static/frontend/package-lock.json
+++ b/crates/ironclaw_webui_v2_static/frontend/package-lock.json
@@ -17,6 +17,10 @@
       },
       "devDependencies": {
         "esbuild": "0.25.0"
+      },
+      "engines": {
+        "node": ">=22 <23",
+        "npm": ">=10"
       }
     },
     "node_modules/@esbuild/aix-ppc64": {
diff --git a/crates/ironclaw_webui_v2_static/frontend/package.json b/crates/ironclaw_webui_v2_static/frontend/package.json
index 7e8ac5a8a7c..18888a1d763 100644
--- a/crates/ironclaw_webui_v2_static/frontend/package.json
+++ b/crates/ironclaw_webui_v2_static/frontend/package.json
@@ -4,6 +4,10 @@
   "private": true,
   "description": "Build tooling for the WebUI v2 SPA. Bundles the local ES modules and the React ecosystem into static/dist via esbuild. NOT a runtime npm package — cargo never invokes this. Run ./build.sh by hand after editing static/js/** or to refresh vendored deps; the outputs under static/dist and static/vendor are committed so cargo build needs no network or node.",
   "type": "module",
+  "engines": {
+    "node": ">=22 <23",
+    "npm": ">=10"
+  },
   "scripts": {
     "build": "node build.mjs",
     "vendor": "bash vendor.sh",