diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 752dd8e..2c5fe99 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -45,7 +45,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "npm"
           cache-dependency-path: frontend/package-lock.json
 
@@ -75,16 +75,13 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      # The act runner base image ships Ubuntu 22.04 with Python 3.10.
-      # Our package requires 3.12, so install it from the deadsnakes PPA.
-      - name: Install Python 3.12
-        run: |
-          apt-get update -qq
-          apt-get install -y -qq software-properties-common
-          add-apt-repository -y ppa:deadsnakes/ppa
-          apt-get update -qq
-          apt-get install -y -qq python3.12 python3.12-dev python3.12-venv python3-pip git
-          python3.12 -m ensurepip --upgrade
+      # Python 3.12 is pre-installed in the runner-base image (py3.12-node22).
+      - name: Cache pip wheels
+        uses: actions/cache@v3
+        with:
+          path: ~/.cache/pip
+          key: pip-${{ hashFiles('pyproject.toml') }}
+          restore-keys: pip-
 
       - name: Create virtual environment
         run: python3.12 -m venv /opt/venv
diff --git a/Dockerfile b/Dockerfile
index 3742242..8a8275d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Stage 1: Build Vue frontend
-FROM node:20-alpine AS build-frontend
+FROM node:22-alpine AS build-frontend
 WORKDIR /build
 COPY frontend/package.json frontend/package-lock.json* ./
 RUN npm install -g npm@latest --quiet && npm install
diff --git a/infra/Dockerfile.runner-base b/infra/Dockerfile.runner-base
new file mode 100644
index 0000000..348f31f
--- /dev/null
+++ b/infra/Dockerfile.runner-base
@@ -0,0 +1,24 @@
+# Runner base image for Forgejo act_runner job containers.
+# Pre-installs Python 3.12 and Node 20 so the test job skips the
+# ~3-4 minute deadsnakes PPA install on every run.
+#
+# Build and push (one-time setup, re-run if this file changes):
+#   docker build -f infra/Dockerfile.runner-base \
+#     -t git.fabledsword.com/bvandeusen/runner-base:py3.12-node22 .
+#   docker push git.fabledsword.com/bvandeusen/runner-base:py3.12-node22
+#
+# Then redeploy the act_runner stack in Portainer to pick up the new label.
+
+FROM ubuntu:24.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Python 3.12 ships in Ubuntu 24.04 main repos — no PPA needed.
+RUN apt-get update -qq && \
+    apt-get install -y -qq \
+      python3.12 python3.12-dev python3.12-venv python3-pip \
+      git curl ca-certificates gnupg && \
+    # Node 22 LTS via NodeSource
+    curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
+    apt-get install -y -qq nodejs && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*
diff --git a/infra/runner-compose.yml b/infra/runner-compose.yml
index 3b9fbc8..1554ec1 100644
--- a/infra/runner-compose.yml
+++ b/infra/runner-compose.yml
@@ -13,7 +13,7 @@ services:
       - GITEA_RUNNER_REGISTRATION_TOKEN=${RUNNER_TOKEN}
       - GITEA_RUNNER_NAME=swarm-runner
       # Maps the runs-on: ubuntu-latest label used in workflow files to a Docker image.
-      - GITEA_RUNNER_LABELS=ubuntu-latest:docker://node:20-bullseye
+      - GITEA_RUNNER_LABELS=ubuntu-latest:docker://git.fabledsword.com/bvandeusen/runner-base:py3.12-node22
       - CONFIG_FILE=/config/config.yml
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock