diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index deb9e32d..31b2f938 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,4 +1,7 @@
 name: Build
+permissions:
+  contents: read
+  pull-requests: write
 
 on:
   - pull_request
@@ -11,7 +14,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
         with:
-          version: 9.10.0 # match package.json:packageManager version.
+          version: 10.11.0 # match package.json:packageManager version.
       - uses: actions/setup-node@v4
         with:
           node-version: 22
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index ce6382a8..e7cb3dd2 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,5 +1,9 @@
 name: Lint
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   - pull_request
 
@@ -11,7 +15,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
         with:
-          version: 9.10.0 # match package.json:packageManager version.
+          version: 10.11.0 # match package.json:packageManager version.
       - uses: actions/setup-node@v4
         with:
           node-version: 22
diff --git a/.github/workflows/test-e2e.yml b/.github/workflows/test-e2e.yml
index 70971263..427ab740 100644
--- a/.github/workflows/test-e2e.yml
+++ b/.github/workflows/test-e2e.yml
@@ -1,4 +1,9 @@
 name: E2E Tests
+
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     branches: [main]
@@ -12,7 +17,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
         with:
-          version: 9.10.0 # match package.json:packageManager version.
+          version: 10.11.0 # match package.json:packageManager version.
       - uses: actions/setup-node@v4
         with:
           node-version: 22
diff --git a/.github/workflows/test-unit.yml b/.github/workflows/test-unit.yml
index d88c3b48..1df18977 100644
--- a/.github/workflows/test-unit.yml
+++ b/.github/workflows/test-unit.yml
@@ -1,5 +1,9 @@
 name: Unit Tests
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   - pull_request
 
@@ -16,7 +20,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
         with:
-          version: 9.10.0 # match package.json:packageManager version.
+          version: 10.11.0 # match package.json:packageManager version.
       - uses: actions/setup-node@v4
         with:
           node-version: 22
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
index a517c8e9..c6c98577 100644
--- a/.github/workflows/typecheck.yml
+++ b/.github/workflows/typecheck.yml
@@ -1,5 +1,9 @@
 name: Type Check
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   - pull_request
 
@@ -14,7 +18,7 @@ jobs:
           node-version: 22
       - uses: pnpm/action-setup@v4
         with:
-          version: 9.10.0 # match package.json:packageManager version.
+          version: 10.11.0 # match package.json:packageManager version.
 
       - name: Get pnpm store directory
         shell: bash
diff --git a/.nvmrc b/.nvmrc
index b8ffd707..5b540673 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-22.15.0
+22.16.0
diff --git a/package.json b/package.json
index fc549554..01589eaf 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,7 @@
     "node": ">=v22.15.0"
   },
   "type": "module",
-  "packageManager": "pnpm@9.10.0",
+  "packageManager": "pnpm@10.11.0",
   "config": {
     "commitizen": {
       "path": "./node_modules/git-cz"