diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index aed1bb56..2da99daa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -67,7 +67,7 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10
+          version: 10.34.3
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 00000000..209e3ef4
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+20
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index a0b7bad7..f6e69dd6 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -40,7 +40,9 @@ Signing is automatic and takes one comment:
 
 ## Development setup
 
-Requirements: **Node.js 20+** and **pnpm 8+**.
+Requirements: **Node.js 20 (LTS)** and **pnpm 10**. Run `nvm use` (reads
+`.nvmrc`); Corepack activates the pinned pnpm from the `packageManager` field
+automatically — don't install pnpm globally.
 
 ```bash
 pnpm install          # install all workspace dependencies
diff --git a/Dockerfile b/Dockerfile
index 99902eb2..76a8e5fc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,7 +5,7 @@
 # Stage 1: Install dependencies and build frontend
 FROM node:20-slim AS builder
 
-RUN corepack enable && corepack prepare pnpm@latest --activate
+RUN corepack enable && corepack prepare pnpm@10.34.3 --activate
 
 WORKDIR /app
 
@@ -36,7 +36,7 @@ RUN pnpm --filter @backspace/web build
 # Stage 2: Production runtime
 FROM node:20-slim AS runtime
 
-RUN corepack enable && corepack prepare pnpm@latest --activate
+RUN corepack enable && corepack prepare pnpm@10.34.3 --activate
 
 # Install build dependencies for better-sqlite3 native module
 RUN apt-get update && \
diff --git a/README.md b/README.md
index 82edf722..2a9630f5 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@
 
 [![License: AGPL-3.0](https://img.shields.io/badge/license-AGPL--3.0-3da639.svg)](LICENSE)
 [![TypeScript](https://img.shields.io/badge/TypeScript-strict-3178c6.svg)](https://www.typescriptlang.org/)
-[![Node.js](https://img.shields.io/badge/node-%E2%89%A520-339933.svg)](https://nodejs.org/)
+[![Node.js](https://img.shields.io/badge/node-20_LTS-339933.svg)](https://nodejs.org/)
 [![Version](https://img.shields.io/badge/version-1.0.0-16a34a.svg)](#project-status)
 
 </div>
@@ -257,7 +257,10 @@ The stack runs three services via Docker Compose:
 
 ## Development
 
-Requirements: **Node.js 20+** and **pnpm 8+**.
+Requirements: **Node.js 20 (LTS)** and **pnpm 10** — both are pinned (`.nvmrc` +
+the `packageManager` field), so `nvm use` and Corepack select the right versions
+automatically. Newer Node majors are untested; the Docker image always builds on
+Node 20 regardless of your host.
 
 ```bash
 pnpm install
@@ -382,7 +385,7 @@ packages/
 
 | Layer        | Technology |
 |--------------|------------|
-| Server       | Node.js 20+, Fastify 4, TypeScript (strict) |
+| Server       | Node.js 20 (LTS), Fastify 4, TypeScript (strict) |
 | Database     | SQLite (better-sqlite3) + Drizzle ORM |
 | Auth         | JWT + bcrypt |
 | Frontend     | React 18, Vite 6, Tailwind CSS 3, Zustand 5 |
diff --git a/package.json b/package.json
index 868c7715..7e679181 100644
--- a/package.json
+++ b/package.json
@@ -38,8 +38,9 @@
       "uiohook-napi@1.5.5": "patches/uiohook-napi@1.5.5.patch"
     }
   },
+  "packageManager": "pnpm@10.34.3",
   "engines": {
-    "node": ">=20.0.0",
-    "pnpm": ">=8.0.0"
+    "node": ">=20.0.0 <21.0.0",
+    "pnpm": ">=10.0.0"
   }
 }