diff --git a/.github/workflows/backend-tests.yml b/.github/workflows/backend-tests.yml
index a4bfed79e66..0d75b4f93c5 100644
--- a/.github/workflows/backend-tests.yml
+++ b/.github/workflows/backend-tests.yml
@@ -28,7 +28,7 @@ jobs:
       fail-fast: false
       matrix:
         # PRs: test on latest Node only. Push to develop: full matrix.
-        node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[22, 24, 25]') }}
+        node: ${{ github.event_name == 'pull_request' && fromJSON('[25]') || fromJSON('[22, 24, 25]') }}
     steps:
       -
         name: Checkout repository
@@ -101,7 +101,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[22, 24, 25]') }}
+        node: ${{ github.event_name == 'pull_request' && fromJSON('[25]') || fromJSON('[22, 24, 25]') }}
     steps:
       -
         name: Checkout repository
diff --git a/.github/workflows/build-and-deploy-docs.yml b/.github/workflows/build-and-deploy-docs.yml
index 826b4687773..18f23cc6cf5 100644
--- a/.github/workflows/build-and-deploy-docs.yml
+++ b/.github/workflows/build-and-deploy-docs.yml
@@ -61,7 +61,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 25
           cache: pnpm
       - name: Setup Pages
         if: github.event_name == 'push'
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index a0c7b33f782..e1ff5630071 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -59,7 +59,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 25
           cache: pnpm
           cache-dependency-path: etherpad/pnpm-lock.yaml
       -
diff --git a/.github/workflows/frontend-admin-tests.yml b/.github/workflows/frontend-admin-tests.yml
index 544f801b373..db13a4f918c 100644
--- a/.github/workflows/frontend-admin-tests.yml
+++ b/.github/workflows/frontend-admin-tests.yml
@@ -22,7 +22,7 @@ jobs:
       fail-fast: false
       matrix:
         # PRs: single Node version. Push: full matrix.
-        node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[22, 24, 25]') }}
+        node: ${{ github.event_name == 'pull_request' && fromJSON('[25]') || fromJSON('[22, 24, 25]') }}
 
     steps:
       -
diff --git a/.github/workflows/frontend-tests.yml b/.github/workflows/frontend-tests.yml
index 0a349e09105..e667e2c62d2 100644
--- a/.github/workflows/frontend-tests.yml
+++ b/.github/workflows/frontend-tests.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 25
           cache: pnpm
       -
         name: Install all dependencies and symlink for ep_etherpad-lite
@@ -114,7 +114,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 25
           cache: pnpm
       - name: Install all dependencies and symlink for ep_etherpad-lite
         run: pnpm install --frozen-lockfile
@@ -190,7 +190,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 25
           cache: pnpm
       - name: Install all dependencies and symlink for ep_etherpad-lite
         run: pnpm install --frozen-lockfile
@@ -291,7 +291,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 25
           cache: pnpm
       - name: Install all dependencies and symlink for ep_etherpad-lite
         run: pnpm install --frozen-lockfile
diff --git a/.github/workflows/handleRelease.yml b/.github/workflows/handleRelease.yml
index a2a2bac2e67..320e1104fe3 100644
--- a/.github/workflows/handleRelease.yml
+++ b/.github/workflows/handleRelease.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 25
           cache: pnpm
       - name: Install all dependencies and symlink for ep_etherpad-lite
         run: pnpm install --frozen-lockfile
diff --git a/.github/workflows/installer-test.yml b/.github/workflows/installer-test.yml
index d77c277a18e..aa4af2192cb 100644
--- a/.github/workflows/installer-test.yml
+++ b/.github/workflows/installer-test.yml
@@ -42,7 +42,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 25
 
       - name: Pre-install pnpm (avoid sudo prompt in the installer)
         run: npm install -g pnpm
@@ -50,8 +50,8 @@ jobs:
       - name: Run bin/installer.sh against this commit
         env:
           ETHERPAD_DIR: ${{ runner.temp }}/etherpad-installer-test
-          ETHERPAD_REPO: ${{ github.server_url }}/${{ github.repository }}.git
-          ETHERPAD_BRANCH: ${{ github.head_ref || github.ref_name }}
+          ETHERPAD_REPO: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.clone_url || format('{0}/{1}.git', github.server_url, github.repository) }}
+          ETHERPAD_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.ref_name }}
           NO_COLOR: "1"
         run: sh ./bin/installer.sh
 
@@ -104,7 +104,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 25
 
       - name: Pre-install pnpm
         run: npm install -g pnpm
@@ -113,8 +113,8 @@ jobs:
         shell: pwsh
         env:
           ETHERPAD_DIR: ${{ runner.temp }}\etherpad-installer-test
-          ETHERPAD_REPO: ${{ github.server_url }}/${{ github.repository }}.git
-          ETHERPAD_BRANCH: ${{ github.head_ref || github.ref_name }}
+          ETHERPAD_REPO: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.clone_url || format('{0}/{1}.git', github.server_url, github.repository) }}
+          ETHERPAD_BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.ref_name }}
           NO_COLOR: "1"
         run: ./bin/installer.ps1
 
diff --git a/.github/workflows/load-test.yml b/.github/workflows/load-test.yml
index a3be2745179..a5431171d5e 100644
--- a/.github/workflows/load-test.yml
+++ b/.github/workflows/load-test.yml
@@ -39,7 +39,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 25
           cache: pnpm
       -
         name: Install all dependencies and symlink for ep_etherpad-lite
@@ -77,7 +77,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 25
           cache: pnpm
       -
         name: Install etherpad-load-test
@@ -140,7 +140,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 25
           cache: pnpm
       -
         name: Install all dependencies and symlink for ep_etherpad-lite
diff --git a/.github/workflows/perform-type-check.yml b/.github/workflows/perform-type-check.yml
index af155c3273d..c9932f936e6 100644
--- a/.github/workflows/perform-type-check.yml
+++ b/.github/workflows/perform-type-check.yml
@@ -39,7 +39,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 25
           cache: pnpm
       - name: Install all dependencies and symlink for ep_etherpad-lite
         run: pnpm install --frozen-lockfile
diff --git a/.github/workflows/rate-limit.yml b/.github/workflows/rate-limit.yml
index 2363f98d64b..7e7ad9b744e 100644
--- a/.github/workflows/rate-limit.yml
+++ b/.github/workflows/rate-limit.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 25
           cache: pnpm
 
       -
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 583067226fa..2dbc95969c9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -64,7 +64,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 25
           cache: pnpm
           cache-dependency-path: etherpad/pnpm-lock.yaml
       - name: Install dependencies ether.github.com
diff --git a/.github/workflows/releaseEtherpad.yml b/.github/workflows/releaseEtherpad.yml
index 60d7ce7f5ca..b6927ce9d35 100644
--- a/.github/workflows/releaseEtherpad.yml
+++ b/.github/workflows/releaseEtherpad.yml
@@ -17,9 +17,8 @@ jobs:
         - uses: actions/setup-node@v6
           with:
             # OIDC trusted publishing needs npm >= 11.5.1, which requires
-            # Node >= 22.9.0. setup-node's `22` resolves to the latest
-            # 22.x, which satisfies that.
-            node-version: 22
+            # Node >= 22.9.0. Node 25 satisfies that and matches the rest of CI.
+            node-version: 25
             registry-url: https://registry.npmjs.org/
         - name: Upgrade npm to >=11.5.1 (required for trusted publishing)
           run: npm install -g npm@latest
diff --git a/.github/workflows/update-plugins.yml b/.github/workflows/update-plugins.yml
index ca9b01844e6..868e381e42a 100644
--- a/.github/workflows/update-plugins.yml
+++ b/.github/workflows/update-plugins.yml
@@ -26,7 +26,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 25
 
       - name: Install bin dependencies
         working-directory: ./bin
diff --git a/.github/workflows/upgrade-from-latest-release.yml b/.github/workflows/upgrade-from-latest-release.yml
index 00d2291ec6a..f7866458a9a 100644
--- a/.github/workflows/upgrade-from-latest-release.yml
+++ b/.github/workflows/upgrade-from-latest-release.yml
@@ -28,13 +28,16 @@ jobs:
       fail-fast: false
       matrix:
         # PRs: single Node version. Push: full matrix.
-        node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[22, 24, 25]') }}
+        node: ${{ github.event_name == 'pull_request' && fromJSON('[25]') || fromJSON('[22, 24, 25]') }}
     steps:
       -
         name: Check out latest release
         uses: actions/checkout@v6
         with:
-          ref: develop #FIXME change to master when doing release
+          fetch-depth: 0
+      -
+        name: Check out latest release tag
+        run: git checkout "$(git tag --list 'v*' --sort=-version:refname | head -n1)"
       - uses: actions/cache@v5
         name: Cache pnpm store
         with:
@@ -84,13 +87,10 @@ jobs:
       -
         name: Install all dependencies and symlink for ep_etherpad-lite
         run: pnpm install --frozen-lockfile
-      # Because actions/checkout@v6 is called with "ref: master" and without
-      # "fetch-depth: 0", the local clone does not have the ${GITHUB_SHA}
-      # commit. Fetch ${GITHUB_REF} to get the ${GITHUB_SHA} commit. Note that a
-      # plain "git fetch" only fetches "normal" references (refs/heads/* and
-      # refs/tags/*), and for pull requests none of the normal references
-      # include ${GITHUB_SHA}, so we have to explicitly tell Git to fetch
-      # ${GITHUB_REF}.
+      # The job starts from the latest release tag, so fetch the pull-request
+      # ref explicitly before checking out ${GITHUB_SHA}. A plain "git fetch"
+      # only brings "normal" references (refs/heads/* and refs/tags/*), and for
+      # pull requests none of those include the synthetic merge commit.
       -
         name: Fetch the new Git commits
         run: git fetch --depth=1 origin "${GITHUB_REF}"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1f173fd0e06..8e6f7a07a8e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Unreleased
 
+### Breaking changes
+
+- **Node 25 is now the default development and CI target.** `packageManager` is now `pnpm@11.1.2` and `engines.pnpm` requires `>=11.1.2`. Node 25 [stopped shipping Corepack](https://github.com/nodejs/node/pull/57617); install pnpm directly with `npm install -g pnpm` (or follow the existing `bin/installer.sh` one-liner, which does this for you).
+
 ### Notable enhancements
 
 - **Self-update subsystem — Tier 2 (manual click).**
@@ -60,7 +64,7 @@
 
 - The HTTP client in the backend has been migrated from `axios` to the built-in `fetch` API, dropping a dependency now that Node 22 ships a stable fetch.
 - `admin/` and `ui/` workspaces moved from `rolldown-vite` to upstream **Vite 8**.
-- Build and CI moved to **pnpm 11** (`packageManager: "pnpm@11.0.6"`); the `Dockerfile`, snap, and all GitHub workflows are aligned. pnpm overrides have been migrated from `package.json` to `pnpm-workspace.yaml` to match pnpm 11's expectations.
+- Build and CI moved to **pnpm 11** (`packageManager: "pnpm@11.1.2"`); the `Dockerfile`, snap, and all GitHub workflows are aligned. pnpm overrides have been migrated from `package.json` to `pnpm-workspace.yaml` to match pnpm 11's expectations.
 - All client modules have been converted to ESM.
 - The CI matrix tests Node 22, 24, and 25; on PRs the matrix is reduced to a single Node version to keep feedback fast.
 - Frontend Playwright tests now run against the `/ether` plugin set, with feature-tag based skips so plugin-incompatible specs are excluded automatically.
diff --git a/package.json b/package.json
index 1d18ac543eb..24918240f50 100644
--- a/package.json
+++ b/package.json
@@ -42,9 +42,10 @@
     "ui": "link:ui"
   },
   "engines": {
-    "node": ">=22.13.0"
+    "node": ">=22.13.0",
+    "pnpm": ">=11.1.2"
   },
-  "packageManager": "pnpm@11.0.6",
+  "packageManager": "pnpm@11.1.2",
   "repository": {
     "type": "git",
     "url": "https://github.com/ether/etherpad.git"