diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
index 9a44fad..36756c9 100644
--- a/.github/workflows/commitlint.yml
+++ b/.github/workflows/commitlint.yml
@@ -18,8 +18,18 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Lint commits with commitlint
-        uses: wagoid/commitlint-github-action@v6
+      # pnpm via Corepack + the repo's own @commitlint/cli, instead of the
+      # wagoid marketplace action, which isn't on the allowed-actions list.
+      - name: Enable Corepack (pnpm)
+        run: corepack enable
+
+      - uses: actions/setup-node@v4
         with:
-          configFile: .commitlintrc.json
-          failOnWarnings: false
+          node-version: 20
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint commits with commitlint
+        run: pnpm exec commitlint --config .commitlintrc.json --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }}
diff --git a/.github/workflows/init-wizard.yml b/.github/workflows/init-wizard.yml
index 5e4e91d..07a01b4 100644
--- a/.github/workflows/init-wizard.yml
+++ b/.github/workflows/init-wizard.yml
@@ -26,13 +26,16 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 9
+      # pnpm via Corepack — pnpm/action-setup isn't on the allowed-actions list.
+      - name: Enable Corepack (pnpm)
+        run: corepack enable
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          # 22, not 20: the test:init script uses `node --test "<glob>"`, and
+          # test-runner glob support landed in Node 21. (The init wizard has no
+          # Node-20 floor — only the pipeline package pins to 20.)
+          node-version: 22
           cache: pnpm
 
       - name: Install dependencies
diff --git a/.github/workflows/lighthouse-ci.yml b/.github/workflows/lighthouse-ci.yml
index f3958b1..cb1c425 100644
--- a/.github/workflows/lighthouse-ci.yml
+++ b/.github/workflows/lighthouse-ci.yml
@@ -44,11 +44,9 @@ jobs:
         with:
           node-version: "20"
 
-      - name: Set up pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: "9.15.0"
-          run_install: false
+      # pnpm via Corepack — pnpm/action-setup isn't on the allowed-actions list.
+      - name: Enable Corepack (pnpm)
+        run: corepack enable
 
       - name: Restore pnpm store
         uses: actions/cache@v4
@@ -75,6 +73,20 @@ jobs:
             sleep 2
           done
 
+      # A responding container only means the install wizard is up — WordPress
+      # core still has to be installed before WooCommerce can be bootstrapped.
+      - name: Install WordPress core
+        run: |
+          docker compose exec -T wordpress wp core is-installed --allow-root 2>/dev/null \
+            || docker compose exec -T wordpress wp core install \
+                 --url="http://localhost:8080" \
+                 --title="Flavian CI" \
+                 --admin_user=admin \
+                 --admin_password=admin \
+                 --admin_email=admin@example.com \
+                 --skip-email \
+                 --allow-root
+
       - name: Install WooCommerce (no sample data)
         env:
           WC_INSTALL_SAMPLE_DATA: "false"
@@ -83,13 +95,11 @@ jobs:
       - name: Seed deterministic content
         run: bash tests/visual/seed.sh
 
+      # lhci CLI (already a devDependency) instead of the treosh marketplace
+      # action, which isn't on this repo's allowed-actions list.
       - name: Run Lighthouse CI
         id: lhci
-        uses: treosh/lighthouse-ci-action@v12
-        with:
-          configPath: ./lighthouserc.json
-          uploadArtifacts: true
-          temporaryPublicStorage: true
+        run: pnpm exec lhci autorun --config=./lighthouserc.json --upload.target=temporary-public-storage
 
       - name: Annotate failing budgets
         if: always()
diff --git a/.github/workflows/pipeline-tests.yml b/.github/workflows/pipeline-tests.yml
index 92aebc0..514800e 100644
--- a/.github/workflows/pipeline-tests.yml
+++ b/.github/workflows/pipeline-tests.yml
@@ -28,6 +28,7 @@ jobs:
               - 'bin/flavian.mjs'
               - 'scripts/indesign-fse/**'
               - 'tests/fixtures/indesign/**'
+              - '.github/workflows/pipeline-tests.yml'
 
   test:
     needs: check-paths
@@ -64,9 +65,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 9.15.0
+      # pnpm via Corepack (bundled with Node) — the pnpm/action-setup
+      # marketplace action isn't on this repo's allowed-actions list.
+      - name: Enable Corepack (pnpm)
+        run: corepack enable
 
       - uses: actions/setup-node@v4
         with:
diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index fe899ef..63200de 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -45,10 +45,9 @@ jobs:
         with:
           node-version: '20'
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
+      # pnpm via Corepack — pnpm/action-setup isn't on the allowed-actions list.
+      - name: Enable Corepack (pnpm)
+        run: corepack enable
 
       - name: Install Composer dependencies
         run: composer install --no-interaction --prefer-dist --quiet
diff --git a/.github/workflows/visual-regression.yml b/.github/workflows/visual-regression.yml
index de9087f..164d32b 100644
--- a/.github/workflows/visual-regression.yml
+++ b/.github/workflows/visual-regression.yml
@@ -53,11 +53,9 @@ jobs:
         with:
           node-version: "20"
 
-      - name: Set up pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: "9.15.0"
-          run_install: false
+      # pnpm via Corepack — pnpm/action-setup isn't on the allowed-actions list.
+      - name: Enable Corepack (pnpm)
+        run: corepack enable
 
       - name: Restore pnpm store
         uses: actions/cache@v4
@@ -87,6 +85,20 @@ jobs:
             sleep 2
           done
 
+      # A responding container only means the install wizard is up — WordPress
+      # core still has to be installed before WooCommerce can be bootstrapped.
+      - name: Install WordPress core
+        run: |
+          docker compose exec -T wordpress wp core is-installed --allow-root 2>/dev/null \
+            || docker compose exec -T wordpress wp core install \
+                 --url="http://localhost:8080" \
+                 --title="Flavian CI" \
+                 --admin_user=admin \
+                 --admin_password=admin \
+                 --admin_email=admin@example.com \
+                 --skip-email \
+                 --allow-root
+
       - name: Install WooCommerce (no sample data)
         env:
           WC_INSTALL_SAMPLE_DATA: "false"
diff --git a/Dockerfile b/Dockerfile
index e7235bf..20ac1a4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -56,11 +56,14 @@ COPY --from=php-extensions /usr/local/etc/php/conf.d/ /usr/local/etc/php/conf.d/
 COPY --from=wp-cli-builder /wp-cli.phar /usr/local/bin/wp
 RUN chmod +x /usr/local/bin/wp
 
-# Install runtime dependencies only (smaller than build dependencies)
+# Install runtime dependencies only (smaller than build dependencies).
+# Note: libzip5 (not libzip4) — the libzip soname bumped to .so.5 in Debian 13
+# (trixie), the base of wordpress:php8.3-apache. The other runtime libs kept
+# their names across bookworm→trixie.
 RUN apt-get update && apt-get install -y --no-install-recommends \
     less \
     mariadb-client \
-    libzip4 \
+    libzip5 \
     libpng16-16 \
     libjpeg62-turbo \
     libfreetype6 \
diff --git a/lighthouserc.json b/lighthouserc.json
index 7bdcfce..815002b 100644
--- a/lighthouserc.json
+++ b/lighthouserc.json
@@ -1,5 +1,5 @@
 {
-  "$comment": "Lighthouse CI config. See https://github.com/GoogleChrome/lighthouse-ci/blob/main/docs/configuration.md. Mobile preset is the Lighthouse default — keeping it implicit. Resource budgets live in tests/lighthouse/budgets.json so they can be tuned without touching CI config.",
+  "$comment": "Lighthouse CI config. See https://github.com/GoogleChrome/lighthouse-ci/blob/main/docs/configuration.md. Mobile preset is the Lighthouse default — keeping it implicit. Resource budgets live in tests/lighthouse/budgets.json; Lighthouse still consumes them for the report. NOTE: the `performance-budget`/`timing-budget` *audit* assertions were dropped — those meta-audits aren't emitted by Lighthouse 12 (the bundled version), so asserting on them fails unconditionally with 'not a known audit'. Budget regressions are caught via the category + CLS assertions below; re-add budget assertions only with a LH12-compatible mechanism.",
   "ci": {
     "collect": {
       "url": [
@@ -16,8 +16,6 @@
     },
     "assert": {
       "assertions": {
-        "performance-budget": ["error", { "maxLength": 0 }],
-        "timing-budget":      ["error", { "maxLength": 0 }],
         "categories:performance":    ["error", { "minScore": 0.70 }],
         "categories:accessibility":  ["error", { "minScore": 0.90 }],
         "categories:best-practices": ["warn",  { "minScore": 0.90 }],
diff --git a/packages/pipeline/package.json b/packages/pipeline/package.json
index 268ce8d..7c59f75 100644
--- a/packages/pipeline/package.json
+++ b/packages/pipeline/package.json
@@ -15,7 +15,7 @@
     "flavian-generate-theme": "./bin/generate-theme.mjs"
   },
   "scripts": {
-    "test": "node --test \"tests/**/*.test.mjs\""
+    "test": "node --test"
   },
   "dependencies": {
     "fast-xml-parser": "^5.7.0",