diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index 7c99c7476c..4dd7e67741 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -15,6 +15,9 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
+        env:
+          # Node 24 (forced for node20 actions) may not trust system CAs by default.
+          NODE_OPTIONS: --use-system-ca
         with:
           # Exclusion-only patterns match every non-excluded file under the
           # default "some" quantifier. Require all patterns (including "**")
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index e3a34e94c5..2b06695a78 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -15,6 +15,9 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
+        env:
+          # Node 24 (forced for node20 actions) may not trust system CAs by default.
+          NODE_OPTIONS: --use-system-ca
         with:
           # Exclusion-only patterns match every non-excluded file under the
           # default "some" quantifier. Require all patterns (including "**")
diff --git a/.github/workflows/type-checker.yml b/.github/workflows/type-checker.yml
index 9cb6889247..c064931b34 100644
--- a/.github/workflows/type-checker.yml
+++ b/.github/workflows/type-checker.yml
@@ -15,6 +15,9 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
+        env:
+          # Node 24 (forced for node20 actions) may not trust system CAs by default.
+          NODE_OPTIONS: --use-system-ca
         with:
           # Exclusion-only patterns match every non-excluded file under the
           # default "some" quantifier. Require all patterns (including "**")
diff --git a/.github/workflows/vulnerability-scan.yml b/.github/workflows/vulnerability-scan.yml
index 0c760c6baa..8ce2e72838 100644
--- a/.github/workflows/vulnerability-scan.yml
+++ b/.github/workflows/vulnerability-scan.yml
@@ -23,6 +23,9 @@ jobs:
       - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
         if: github.event_name == 'pull_request'
+        env:
+          # Node 24 (forced for node20 actions) may not trust system CAs by default.
+          NODE_OPTIONS: --use-system-ca
         with:
           # Exclusion-only patterns match every non-excluded file under the
           # default "some" quantifier. Require all patterns (including "**")