diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7bf19eb..34c9bcd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,8 @@ jobs:
     # The local commit-msg hook (.husky/commit-msg) can be bypassed -- a merge via the GitHub web UI, a commit from a tool that doesn't run hooks. This checks every commit on a pull request against the same rules. Nothing to check on a plain push to main: those commits already passed this exact job on their pull request.
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    # 5 has been observed too tight: npm ci installing this repository's ~500 packages has intermittently taken most of 5 minutes on GitHub's shared runners even with a warm actions/setup-node cache, independent of which Node version is in use -- every job below that runs npm ci gets the same headroom.
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:
@@ -54,7 +55,7 @@ jobs:
   typecheck:
     name: Typecheck
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:
@@ -69,7 +70,7 @@ jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:
@@ -84,7 +85,7 @@ jobs:
   format:
     name: Format
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:
diff --git a/lint-staged.config.js b/lint-staged.config.js
deleted file mode 100644
index 4ec9856..0000000
--- a/lint-staged.config.js
+++ /dev/null
@@ -1,13 +0,0 @@
-// Plain JS, not lint-staged.config.ts like the repository's other *.config.ts files: lint-staged loads a TypeScript config via dynamic import of the raw file, relying on Node's native type-stripping, which is only on by default from Node 23.6 onward and needs an explicit --experimental-strip-types flag on the Node 22 this repository's CI (and therefore its documented supported version) actually runs. A plain ESM config needs no flag on any supported Node version.
-
-// eslint.config.ts excludes package-lock.json from lint entirely (generated, not hand-maintained); the `!(package-lock).json` glob below applies the same exclusion to prettier, which has no ignores option of its own here.
-export default {
-  "*.{ts,md}": [
-    "eslint --fix --cache --cache-location node_modules/.cache/eslint/.eslintcache",
-    "prettier --write --cache",
-  ],
-  "*.json":
-    "eslint --fix --cache --cache-location node_modules/.cache/eslint/.eslintcache",
-  "!(package-lock).json": "prettier --write --cache",
-  "*.{yml,yaml}": "prettier --write --cache",
-};
diff --git a/lint-staged.config.ts b/lint-staged.config.ts
new file mode 100644
index 0000000..9b1ee8f
--- /dev/null
+++ b/lint-staged.config.ts
@@ -0,0 +1,15 @@
+// lint-staged loads a TypeScript config via dynamic import of the raw file, relying on Node's native type-stripping. That's enabled by default from v23.6.0 onward, and Node backported the same default-enable to the 22.x LTS line at v22.18.0 (https://nodejs.org/en/blog/release/v22.18.0) -- so this can be a real .ts file like the repository's other *.config.ts files instead of needing a plain-JS carve-out. The "engines" field in package.json pins the 22.x floor higher than that, at v22.22.1: not the type-stripping requirement itself, but lint-staged's own declared minimum, which is the binding constraint for this file to load at all.
+
+// eslint.config.ts excludes package-lock.json from lint entirely (generated, not hand-maintained); the `!(package-lock).json` glob below applies the same exclusion to prettier, which has no ignores option of its own here.
+import { defineConfig } from "lint-staged/config";
+
+export default defineConfig({
+  "*.{ts,md}": [
+    "eslint --fix --cache --cache-location node_modules/.cache/eslint/.eslintcache",
+    "prettier --write --cache",
+  ],
+  "*.json":
+    "eslint --fix --cache --cache-location node_modules/.cache/eslint/.eslintcache",
+  "!(package-lock).json": "prettier --write --cache",
+  "*.{yml,yaml}": "prettier --write --cache",
+});
diff --git a/package.json b/package.json
index 0e9874d..23c86e1 100644
--- a/package.json
+++ b/package.json
@@ -4,6 +4,9 @@
   "private": true,
   "type": "module",
   "packageManager": "npm@11.19.0",
+  "engines": {
+    "node": ">=22.22.1 <23.0.0 || >=23.6.0"
+  },
   "description": "Runs Claude Code for pull-request review, issue triage, or interactive @claude assistance, with shared org-wide prompts and per-mode tool allowlists.",
   "scripts": {
     "prepare": "husky",