diff --git a/.github/node-maintenance.json b/.github/node-maintenance.json
new file mode 100644
index 00000000..3045c74f
--- /dev/null
+++ b/.github/node-maintenance.json
@@ -0,0 +1,21 @@
+{
+  "directory": "website",
+  "toolchain": {
+    "node": "24",
+    "pnpm": "11.21.0"
+  },
+  "validationScript": "check",
+  "minimumReleaseAgeDays": 10,
+  "maintenance": {
+    "mode": "security-and-maintenance",
+    "upgradeScope": "major"
+  },
+  "schedule": {
+    "security": [
+      "0 2 * * 1"
+    ],
+    "upgrades": [
+      "0 2 1 */3 *"
+    ]
+  }
+}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 69175ae3..5229e3e5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -180,18 +180,15 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: "22"
+          node-version-file: website/.nvmrc
           cache: pnpm
           cache-dependency-path: website/pnpm-lock.yaml
 
       - name: Install website dependencies
         run: pnpm --dir website install --frozen-lockfile
 
-      - name: Check generated schema docs
-        run: python website/scripts/update_recording_schema_docs.py --check
-
-      - name: Build website
-        run: pnpm --dir website build
+      - name: Check generated schema docs and build website
+        run: pnpm --dir website run check
 
       - name: Summary
         if: always()
diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml
new file mode 100644
index 00000000..176fc559
--- /dev/null
+++ b/.github/workflows/dependency-audit.yml
@@ -0,0 +1,43 @@
+name: Node dependency audit
+
+'on':
+  schedule:
+  - cron: '0 2 * * 1'
+  - cron: '0 2 1 */3 *'
+  workflow_dispatch:
+    inputs:
+      audit-kind:
+        description: Security fixes only, or security plus routine upgrades for this run.
+        type: choice
+        default: security
+        options:
+        - security
+        - upgrades
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependency-audit
+  cancel-in-progress: false
+
+jobs:
+  audit:
+    permissions:
+      contents: read
+      issues: write
+    uses: hydra-ecosystem/github-actions/.github/workflows/node-audit.yml@241d646f6b83d17aeee2bb97a8c1e1e788eb6099
+    with:
+      audit-kind: ${{ inputs.audit-kind || 'auto' }}
+
+  pull-request:
+    needs: audit
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: hydra-ecosystem/github-actions/.github/workflows/node-publish.yml@241d646f6b83d17aeee2bb97a8c1e1e788eb6099
+    with:
+      validation-passed: ${{ needs.audit.outputs.validation_passed }}
+      app-client-id: ${{ vars.NODE_AUDIT_APP_CLIENT_ID }}
+    secrets:
+      app-private-key: ${{ secrets.NODE_AUDIT_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
index 00909a02..d8375120 100644
--- a/.github/workflows/deploy-website.yml
+++ b/.github/workflows/deploy-website.yml
@@ -28,7 +28,7 @@ jobs:
           package_json_file: website/package.json
       - uses: actions/setup-node@v4
         with:
-          node-version: "22"
+          node-version-file: website/.nvmrc
           cache: pnpm
           cache-dependency-path: website/pnpm-lock.yaml
       - name: Install dependencies
diff --git a/MAINTAINERS.md b/MAINTAINERS.md
index ee65d64d..7f0d5823 100644
--- a/MAINTAINERS.md
+++ b/MAINTAINERS.md
@@ -14,34 +14,68 @@ python -m pip install -e '.[dev]'
 
 ## Website development
 
-Install `pnpm` once per machine if needed:
+Use Node 24, as declared in `website/.nvmrc`.
+The website pins pnpm 11.21.0 in `website/package.json`. Enable Corepack
+with your Node installation:
 
 ```bash
-npm install --global pnpm@10.14.0
+corepack enable
 ```
 
 Install the website dependencies once per checkout, and again when the lockfile
 changes:
 
 ```bash
-pnpm --dir website install
+cd website
+corepack pnpm install --frozen-lockfile
 ```
 
 Start the local development server whenever you work on the website:
 
 ```bash
-pnpm --dir website start
+corepack pnpm start
 ```
 
 ## Validation
 
-Run these common checks before submitting a change:
+From the repository root, run these common checks before submitting a change.
+The website check verifies generated schema docs before the production build:
 
 ```bash
 nox -s tests
-pnpm --dir website build
+cd website
+corepack pnpm run check
 ```
 
+## Website dependency maintenance
+
+[Shared Node maintenance workflows](https://github.com/hydra-ecosystem/github-actions/blob/main/docs/node-maintenance.md)
+audit the standalone `website` project and validate proposals with its `check`
+script. This runs the schema checks and production build. The configuration in
+`.github/node-maintenance.json` requires Node 24 and pnpm 11.21.0, matching the
+project declarations. Setup changes are reviewed here; the audit reports a
+configuration mismatch in the run and one configuration issue rather than
+silently rewriting declarations.
+
+Security checks run every Monday at 02:00 UTC. Routine upgrades, including major
+versions, run on the first day of January, April, July, and October at 02:00 UTC.
+To run either check sooner, open **Actions → Node dependency audit → Run workflow**
+on `main` and select `security` or `upgrades`. Change a cadence in both the JSON
+configuration and `.github/workflows/dependency-audit.yml`.
+
+Before the first run, enable **Allow GitHub Actions to create and approve pull
+requests** under **Settings → Actions → General → Workflow permissions**.
+The built-in `GITHUB_TOKEN` opens or updates the maintenance PR after candidate
+validation; it does not trigger additional PR workflows. Maintenance does not
+deploy the website.
+
+The workspace applies a ten-day release delay and explicit dependency build
+script approvals. It retains the existing security overrides and the `core-js`
+build approval. Review any additional approvals a dependency update needs.
+After merging setup, dispatch a `security` audit from `main` and inspect the
+configuration result, validation, and dependency report before merging any
+maintenance PR.
+
 ## Release procedure
 
 Releases are prepared on `main` and published only after the release candidate
diff --git a/website/.nvmrc b/website/.nvmrc
new file mode 100644
index 00000000..a45fd52c
--- /dev/null
+++ b/website/.nvmrc
@@ -0,0 +1 @@
+24
diff --git a/website/package.json b/website/package.json
index 042adead..ab5682b6 100644
--- a/website/package.json
+++ b/website/package.json
@@ -1,12 +1,13 @@
 {
   "name": "omegaflow-website",
   "private": true,
-  "packageManager": "pnpm@11.13.1",
+  "packageManager": "pnpm@11.21.0",
   "scripts": {
     "schema-docs": "python3 scripts/update_recording_schema_docs.py",
     "build": "python3 scripts/update_recording_schema_docs.py && docusaurus build",
     "serve": "docusaurus serve --port 6761",
-    "start": "docusaurus start --port 6761 --no-open"
+    "start": "docusaurus start --port 6761 --no-open",
+    "check": "python3 scripts/update_recording_schema_docs.py --check && pnpm run build"
   },
   "dependencies": {
     "@docusaurus/core": "^3.10.2",
@@ -14,5 +15,8 @@
     "@docusaurus/theme-mermaid": "^3.10.2",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
+  },
+  "engines": {
+    "node": ">=24"
   }
 }
diff --git a/website/pnpm-workspace.yaml b/website/pnpm-workspace.yaml
index 7aa9e15c..85603e2d 100644
--- a/website/pnpm-workspace.yaml
+++ b/website/pnpm-workspace.yaml
@@ -1,5 +1,14 @@
+packages:
+  - "."
+
+minimumReleaseAge: 14400
+blockExoticSubdeps: true
+strictDepBuilds: true
+
 allowBuilds:
   core-js: true
+  core-js-pure: false
+  fsevents: false
 
 overrides:
   copy-webpack-plugin>serialize-javascript: 7.0.5