diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ea7f213..82f3997 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -15,6 +15,11 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
+    ignore:
+      # Keep types at the lowest Node line CI tests (engines >=20, CI on 22/24)
+      - dependency-name: "@types/node"
+        update-types:
+          - version-update:semver-major
     groups:
       npm-minor-patch:
         update-types:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 32b2b14..5a4d5ed 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -128,8 +128,7 @@ jobs:
         with:
           node-version: "24"
           registry-url: https://registry.npmjs.org
-          cache: npm
-          cache-dependency-path: ts/package-lock.json
+          package-manager-cache: false # no shared cache in the OIDC publish job
       - run: npm ci
         working-directory: ts
       - id: version