diff --git a/.github/Dockerfile b/.github/Dockerfile
index 2a03d86d7..541f17dad 100644
--- a/.github/Dockerfile
+++ b/.github/Dockerfile
@@ -48,10 +48,11 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- \
     -c rustfmt -c clippy \
     -t x86_64-unknown-linux-gnu
 
-# Node.js 24.x + yarn
+# Node.js 24.x + pnpm (project's package manager — pinned in package.json)
 RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
-    && npm install -g yarn
+    && corepack enable \
+    && corepack prepare pnpm@10.10.0 --activate
 
 # Install ALSA, X11, input, and E2E automation dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -88,4 +89,4 @@ COPY e2e/docker-entrypoint.sh /docker-entrypoint.sh
 RUN chmod +x /docker-entrypoint.sh
 
 # Verify installs
-RUN rustc --version && cargo --version && node --version && yarn --version && mold --version && sccache --version && which tauri-driver && cargo tauri --version
+RUN rustc --version && cargo --version && node --version && pnpm --version && mold --version && sccache --version && which tauri-driver && cargo tauri --version
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1b963e8e6..ce24a0c50 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -44,23 +44,19 @@ jobs:
           restore-keys: |
             cef-ubuntu-22.04-
 
-      # Note: the vendored CEF-aware tauri-cli is pre-installed in the
-      # ghcr.io/tinyhumansai/openhuman_ci image (see .github/Dockerfile),
-      # so `cargo tauri build` below resolves to the fork without any
-      # per-run compile step.
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+      # Note: the vendored CEF-aware tauri-cli, Node 24, and pnpm are all
+      # pre-installed in the ghcr.io/tinyhumansai/openhuman_ci image (see
+      # .github/Dockerfile), so `cargo tauri build` below resolves to the
+      # fork without any per-run compile step.
+      - name: Cache pnpm store
+        uses: actions/cache@v4
         with:
-          cache: true
-      - name: Setup Node.js 24.x
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24.x
+          path: ~/.local/share/pnpm/store
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            pnpm-store-${{ runner.os }}-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
-      - name: Install cmake (for whisper-rs)
-        run: apt-get update && apt-get install -y --no-install-recommends cmake &&
-          rm -rf /var/lib/apt/lists/*
       # Core is linked into the Tauri binary as a path dep — no separate
       # sidecar build / stage step needed.
       - name: Build Tauri app (CEF default)
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 5ee06c691..0a86243be 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -15,20 +15,21 @@ concurrency:
 jobs:
   frontend-coverage:
     name: Frontend Coverage (Vitest)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
+    container:
+      image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+      - name: Cache pnpm store
+        uses: actions/cache@v4
         with:
-          cache: true
-      - name: Setup Node.js 24.x
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24.x
+          path: ~/.local/share/pnpm/store
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            pnpm-store-${{ runner.os }}-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
       - name: Run Vitest with coverage
@@ -74,8 +75,6 @@ jobs:
           workspaces: . -> target
           cache-on-failure: true
           key: core-coverage
-      - name: Install system dependencies (cmake, ALSA, X11)
-        run: apt-get update && apt-get install -y --no-install-recommends cmake libasound2-dev libxdo-dev libxtst-dev libx11-dev libevdev-dev && rm -rf /var/lib/apt/lists/*
       - name: Install cargo-llvm-cov
         uses: taiki-e/install-action@cargo-llvm-cov
       - name: Run cargo llvm-cov for openhuman core
@@ -116,8 +115,6 @@ jobs:
           key: cef-ubuntu-22.04-${{ hashFiles('app/src-tauri/Cargo.toml') }}
           restore-keys: |
             cef-ubuntu-22.04-
-      - name: Install system dependencies (cmake, ALSA, X11)
-        run: apt-get update && apt-get install -y --no-install-recommends cmake libasound2-dev libxdo-dev libxtst-dev libx11-dev libevdev-dev && rm -rf /var/lib/apt/lists/*
       - name: Install cargo-llvm-cov
         uses: taiki-e/install-action@cargo-llvm-cov
       - name: Run cargo llvm-cov for Tauri shell
diff --git a/.github/workflows/pr-quality.yml b/.github/workflows/pr-quality.yml
index c805cf912..d7aa4c6c7 100644
--- a/.github/workflows/pr-quality.yml
+++ b/.github/workflows/pr-quality.yml
@@ -15,7 +15,9 @@ jobs:
   # blocking merges. Flip to hard-fail once the false-positive rate is stable.
   checklist-guard:
     name: PR Submission Checklist
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
+    container:
+      image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
     continue-on-error: true
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'docs') && !contains(github.event.pull_request.labels.*.name, 'chore') }}
     steps:
@@ -23,17 +25,15 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
-      - name: Setup Node.js 24.x
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24.x
       - name: Verify Submission Checklist
         env:
           PR_BODY: ${{ github.event.pull_request.body }}
         run: node scripts/check-pr-checklist.mjs
   coverage-matrix:
     name: Coverage Matrix Sync
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
+    container:
+      image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
     continue-on-error: true
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'docs') && !contains(github.event.pull_request.labels.*.name, 'chore') }}
     steps:
@@ -41,10 +41,6 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
-      - name: Setup Node.js 24.x
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24.x
       - name: Verify Coverage Matrix
         run: node scripts/check-coverage-matrix.mjs
   markdown-link-check:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 67deab7b6..ed86f53f1 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -22,20 +22,21 @@ concurrency:
 jobs:
   unit-tests:
     name: Frontend Unit Tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
+    container:
+      image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+      - name: Cache pnpm store
+        uses: actions/cache@v4
         with:
-          cache: true
-      - name: Setup Node.js 24.x
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24.x
+          path: ~/.local/share/pnpm/store
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            pnpm-store-${{ runner.os }}-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
       - name: Run tests with coverage
@@ -78,9 +79,6 @@ jobs:
           cache-on-failure: true
           key: core
 
-      - name: Install system dependencies (cmake, ALSA, X11)
-        run: apt-get update && apt-get install -y --no-install-recommends cmake libasound2-dev libxdo-dev libxtst-dev libx11-dev libevdev-dev && rm -rf /var/lib/apt/lists/*
-
       - name: Install sccache
         uses: mozilla-actions/sccache-action@v0.0.9
 
@@ -124,9 +122,6 @@ jobs:
           key: cef-ubuntu-22.04-${{ hashFiles('app/src-tauri/Cargo.toml') }}
           restore-keys: |
             cef-ubuntu-22.04-
-      - name: Install system dependencies (cmake, ALSA, X11)
-        run: apt-get update && apt-get install -y --no-install-recommends cmake libasound2-dev
-          libxdo-dev libxtst-dev libx11-dev libevdev-dev && rm -rf /var/lib/apt/lists/*
       - name: Install sccache
         uses: mozilla-actions/sccache-action@v0.0.9
 
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
index eced03f8f..3c3f95c1b 100644
--- a/.github/workflows/typecheck.yml
+++ b/.github/workflows/typecheck.yml
@@ -14,20 +14,21 @@ concurrency:
 jobs:
   typecheck:
     name: Type Check TypeScript
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
+    container:
+      image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+      - name: Cache pnpm store
+        uses: actions/cache@v4
         with:
-          cache: true
-      - name: Setup Node.js 24.x
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24.x
+          path: ~/.local/share/pnpm/store
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            pnpm-store-${{ runner.os }}-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
       - name: Type check TypeScript files
@@ -58,9 +59,6 @@ jobs:
           workspaces: |
             . -> target
           cache-on-failure: true
-      - name: Install cmake (for whisper-rs)
-        run: apt-get update && apt-get install -y --no-install-recommends cmake &&
-          rm -rf /var/lib/apt/lists/*
       - name: Check formatting (cargo fmt)
         run: cargo fmt --all -- --check
       - name: Run clippy (core crate)
diff --git a/.github/workflows/weekly-code-review.yml b/.github/workflows/weekly-code-review.yml
index 589385701..cb7af3300 100644
--- a/.github/workflows/weekly-code-review.yml
+++ b/.github/workflows/weekly-code-review.yml
@@ -25,7 +25,9 @@ concurrency:
 jobs:
   weekly-review:
     name: Aggregate weekly signals
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
+    container:
+      image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
     timeout-minutes: 30
     steps:
       - name: Checkout repository
@@ -33,26 +35,24 @@ jobs:
         with:
           fetch-depth: 1
 
-      - name: Enable Corepack (for pnpm)
-        run: corepack enable
-
-      - name: Setup Node.js 24.x
-        uses: actions/setup-node@v4
+      - name: Cache pnpm store
+        uses: actions/cache@v4
         with:
-          node-version: 24.x
-          cache: "pnpm"
+          path: ~/.local/share/pnpm/store
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            pnpm-store-${{ runner.os }}-
 
       - name: Install JS dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@1.93.0
-
       - name: Cache cargo-audit binary
         id: cache-cargo-audit
         uses: actions/cache@v4
         with:
-          path: ~/.cargo/bin/cargo-audit
+          # Image sets CARGO_HOME=/usr/local/cargo, so cargo install drops the
+          # binary there — not in $HOME/.cargo/bin.
+          path: /usr/local/cargo/bin/cargo-audit
           key: cargo-audit-${{ runner.os }}-v1
 
       - name: Install cargo-audit