diff --git a/.github/actions/setup-node/action.yml b/.github/actions/setup-node/action.yml
index 8c141ac9..c0afe563 100644
--- a/.github/actions/setup-node/action.yml
+++ b/.github/actions/setup-node/action.yml
@@ -4,24 +4,24 @@ description: Sets up Node and Build SDK
 inputs:
   node-version:
     required: false
-    default: '24'
+    default: '22'
 
 runs:
   using: 'composite'
   steps:
     - name: Setup Node
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: ${{ inputs.node-version }}
         registry-url: 'https://registry.npmjs.org'
 
     - name: Cache Dependencies
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: ./node_modules
         key: ${{ runner.os }}-${{ inputs.node-version }}-modules-${{ hashFiles('**/yarn.lock') }}
         restore-keys: ${{ runner.os }}-${{ inputs.node-version }}-modules-
 
     - name: Install Dependencies & Build
-      run: yarn install --immutable --ignore-engines
+      run: yarn install --frozen-lockfile --ignore-engines
       shell: bash
diff --git a/.github/workflows/browser.yml b/.github/workflows/browser.yml
index b76e4b74..aefd48e5 100644
--- a/.github/workflows/browser.yml
+++ b/.github/workflows/browser.yml
@@ -10,7 +10,7 @@ jobs:
   browser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-node
       - name: Test
         env:
diff --git a/.github/workflows/cloud.yml b/.github/workflows/cloud.yml
index c00d18e9..70cc37a7 100644
--- a/.github/workflows/cloud.yml
+++ b/.github/workflows/cloud.yml
@@ -10,7 +10,7 @@ jobs:
   qa:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-node
       - name: Test
         env:
diff --git a/.github/workflows/initiate_release.yml b/.github/workflows/initiate_release.yml
index 350a7eb9..96a291a4 100644
--- a/.github/workflows/initiate_release.yml
+++ b/.github/workflows/initiate_release.yml
@@ -12,7 +12,7 @@ jobs:
     name: 🚀 Create release PR
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0 # gives the changelog generator access to all previous commits
 
@@ -21,7 +21,7 @@ jobs:
         uses: WyriHaximus/github-action-get-previous-tag@v1
 
       - name: Ensure version number higher than current
-        uses: actions/github-script@v5
+        uses: actions/github-script@v7
         env:
           PREVIOUS_TAG: ${{ steps.previoustag.outputs.tag }}
           DESTINATION_TAG: ${{ github.event.inputs.version }}
@@ -49,7 +49,7 @@ jobs:
           git push -q -u origin "release-$VERSION"
 
       - name: Get changelog diff
-        uses: actions/github-script@v5
+        uses: actions/github-script@v7
         with:
           script: |
             const get_change_log_diff = require('./scripts/get_changelog_diff.js')
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 7c14ea2d..71611a6f 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -10,7 +10,7 @@ jobs:
   integration:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-node
       - name: Test
         env:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 95e9e2b4..2e332a85 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -10,7 +10,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-node
       - name: Lint
         run: yarn run lint
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 85bc4810..420dd856 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,11 +16,11 @@ jobs:
     if: github.event.pull_request.merged && startsWith(github.head_ref, 'release-')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@v7
         with:
           script: |
             const get_change_log_diff = require('./scripts/get_changelog_diff.js')
diff --git a/.github/workflows/size.yml b/.github/workflows/size.yml
index 7682715b..92a17819 100644
--- a/.github/workflows/size.yml
+++ b/.github/workflows/size.yml
@@ -12,7 +12,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: preactjs/compressed-size-action@v2
         with:
           repo-token: '${{ secrets.GITHUB_TOKEN }}'
diff --git a/.github/workflows/type.yml b/.github/workflows/type.yml
index 03577b72..568dc1cb 100644
--- a/.github/workflows/type.yml
+++ b/.github/workflows/type.yml
@@ -10,7 +10,7 @@ jobs:
   types:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-node
       - name: Type check
         run: yarn run types
diff --git a/.github/workflows/unit.yml b/.github/workflows/unit.yml
index 0360ab64..2b3b820a 100644
--- a/.github/workflows/unit.yml
+++ b/.github/workflows/unit.yml
@@ -7,13 +7,20 @@ on:
   pull_request:
 
 jobs:
+  # TODO: remove once branch protection is updated to drop unit (16)
+  unit-legacy:
+    name: 'unit (16)'
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "Deprecated — Node 16 is EOL. This job exists only to satisfy branch protection."
+
   unit:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node: [16, 18]
+        node: [18, 20, 22]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-node
         with:
           node-version: ${{ matrix.node }}
diff --git a/package.json b/package.json
index d3c8e6dc..3b104917 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "test-types": "tsc --skipLibCheck --target es2020 --esModuleInterop true --noEmit true test/typescript/*.ts",
     "test-unit-node": "mocha --require ./babel-register.js test/unit/common test/unit/node",
     "test-integration-node": "mocha --require ./babel-register.js test/integration/common test/integration/node --exit",
-    "test-cloud": "mocha --require ./babel-register.js test/integration/cloud --timeout 40000",
+    "test-cloud": "mocha --require ./babel-register.js test/integration/cloud --timeout 40000 --exit",
     "test-cloud-local": "LOCAL=true mocha --require ./babel-register.js test/integration/cloud --timeout 40000 --ignore 'test/integration/cloud/{personalized_feed,files,images}.js'",
     "test-browser": "karma start karma.config.js",
     "prepare": "yarn run build",