diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 696c6d6a8..7f9365fae 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -85,7 +85,7 @@ revampit/
 |-------|------------|------|
 | Frontend | Next.js 16, TypeScript, Tailwind | 3000 |
 | **Prod DB** | **Self-hosted Postgres on Hetzner** (Supabase stack, `localhost:5432/revampit`) | On the app box |
-| **Dev DB** | PostgreSQL in Docker (`npm run services:up`, port 5433) | localhost:5433 |
+| **Dev DB** | PostgreSQL in Docker (`pnpm run services:up`, port 5433) | localhost:5433 |
 | Search | Meilisearch | 7700 |
 | Payments | Payrexx (mock in dev) | — |
 
@@ -113,7 +113,7 @@ revampit/
 2. **Schema reaches ANY shared database ONLY via `scripts/db/migrations/`.**
    `drizzle-kit push` is FORBIDDEN against dev/prod — push-created tables are
    invisible to from-scratch replays and broke CI for days (see 101b/109
-   baselines). Local ad-hoc DBs: `npm run db:migrate`. The CI Migration Drift
+   baselines). Local ad-hoc DBs: `pnpm run db:migrate`. The CI Migration Drift
    job replays every migration from zero; before pushing a new migration,
    replay locally in a throwaway pgvector container.
 3. **App-level enums live in `src/config/*` + zod at the write boundary — NOT
@@ -191,10 +191,10 @@ Community P2P (individuals + staff posting privately)
 ## Quick Start
 
 ```bash
-npm run d              # Start everything (recommended)
-npm run dev            # Frontend only
-npm run services:up    # Start Docker services
-npm run setup-admins   # Create admin users
+pnpm run d              # Start everything (recommended)
+pnpm run dev            # Frontend only
+pnpm run services:up    # Start Docker services
+pnpm run setup-admins   # Create admin users
 ```
 
 **Full commands**: See `docs/COMMANDS.md`
@@ -275,7 +275,7 @@ This is the #1 most common mistake. EVERY German word with ä, ö, ü MUST use t
 "Billett" ✓   "Ticket" ✗
 ```
 
-**Run `npm run lint:umlauts` to catch ASCII umlaut violations.**
+**Run `pnpm run lint:umlauts` to catch ASCII umlaut violations.**
 **ALWAYS run this before committing German text changes.**
 
 ### 4b. Translation (i18n) SSOT — messages hold STRINGS ONLY
@@ -301,7 +301,7 @@ Anything language-independent must NEVER live in a message file:
   length + per-element keys) — keep it green.
 
 DE is canonical; other locales deep-merge over it. Don't hardcode user-facing
-strings in components — add a key. Run `npm run compliance:i18n` for parity.
+strings in components — add a key. Run `pnpm run compliance:i18n` for parity.
 
 ### 6. Protected Files - NEVER Delete
 - `scripts/db/migrations/*`
@@ -473,8 +473,8 @@ Run `scripts/db/migrations/002b-simplified-auth.sql` to add:
 
 ## Pre-Commit Checklist
 
-- [ ] `npm run typecheck` passes
-- [ ] `npm run lint` passes
+- [ ] `pnpm run typecheck` passes
+- [ ] `pnpm run lint` passes
 - [ ] No `console.log` statements
 - [ ] Using `logger` from `@/lib/logger`
 - [ ] Using `TABLE_NAMES` from `@/config/database`
@@ -486,7 +486,7 @@ Run `scripts/db/migrations/002b-simplified-auth.sql` to add:
 | Document | Purpose |
 |----------|---------|
 | `docs/SHARED_CONTEXT.md` | Tech stack, database, file structure |
-| `docs/COMMANDS.md` | All npm scripts |
+| `docs/COMMANDS.md` | All package scripts |
 | `docs/MISSION_STATEMENT.md` | Organization mission |
 | `docs/CODE_AUDIT.md` | Current issues to fix |
 
@@ -502,4 +502,4 @@ Run `scripts/db/migrations/002b-simplified-auth.sql` to add:
 
 ---
 
-**Last Updated**: 2026-07-17
+**Last Updated**: 2026-09-04
diff --git a/CLAUDE.md b/CLAUDE.md
index fcfefcda0..27198c10e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -91,7 +91,7 @@ hold the line on all of it by default:
 
 | Layer | Technology |
 |-------|-----------|
-| Framework | Next.js 16, TypeScript 5.3 |
+| Framework | Next.js 16, TypeScript 6 |
 | Styling | Tailwind CSS 4 (CSS-first, no tailwind.config) |
 | Database | PostgreSQL (prod: self-hosted on Hetzner; dev: Docker on 5433), Drizzle ORM |
 | Auth | NextAuth v5 (Auth.js) + @auth/pg-adapter |
@@ -307,7 +307,7 @@ grep -rn 'bg-gradient-to' src/app/[locale]/ src/components/ | grep -v 'from-blac
 grep -rnE '(bg|text|border|ring)-primary-[0-9]' src/components src/app
 
 # Hand-rolled card shells — should be <Card>/<Panel> (resolve to card-shell).
-# Enforced as a ratchet: scripts/ci/card-shell-ratchet.sh (runs in `npm run
+# Enforced as a ratchet: scripts/ci/card-shell-ratchet.sh (runs in `pnpm run
 # verify`) pins the count — it may fall or hold, never rise. When you reduce
 # it, lower scripts/ci/card-shell-baseline.txt in the same PR.
 grep -rnE 'bg-surface-base rounded-(lg|xl) border' src/components src/app
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index cbeaf2cea..fc5bc2d8c 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -14,7 +14,7 @@ Thanks for the interest. This document covers the practical workflow for shippin
 ## Prerequisites
 
 - Node.js **20+**
-- A Postgres instance — start local Docker with `npm run services:up` (port 5433). Production runs on self-hosted Postgres 17 on Hetzner.
+- A Postgres instance — start local Docker with `pnpm run services:up` (port 5433). Production runs on self-hosted Postgres 17 on Hetzner.
 - (Optional, for full feature coverage) Meilisearch, Redis (upstash), Listmonk
 
 ## Local setup
@@ -23,14 +23,14 @@ Thanks for the interest. This document covers the practical workflow for shippin
 git clone https://github.com/bitbaum/evig.git
 cd evig
 cp .env.example .env.local         # fill in DATABASE_URL, AUTH_SECRET, payment + email keys
-npm install
-npm run db:migrate                  # apply scripts/db/migrations/*.sql
-npm run dev                         # Next.js on :3000
+pnpm install
+pnpm run db:migrate                  # apply scripts/db/migrations/*.sql
+pnpm run dev                         # Next.js on :3000
 ```
 
 The app is a **single Next.js 16 application**. There is no separate API server, CMS server, or microservice — everything (pages, API routes, admin surface) lives in `src/app/`. Earlier iterations had a `cms-api/` subproject; it is no longer maintained and its files are not part of the dev loop.
 
-Full architecture orientation: [`docs/ARCHITECTURE_QUICK_START.md`](./docs/ARCHITECTURE_QUICK_START.md). Every npm script: [`docs/COMMANDS.md`](./docs/COMMANDS.md).
+Full architecture orientation: [`docs/ARCHITECTURE_QUICK_START.md`](./docs/ARCHITECTURE_QUICK_START.md). Every package script: [`docs/COMMANDS.md`](./docs/COMMANDS.md).
 
 ## Workflow
 
@@ -51,10 +51,10 @@ Lead the body with **why**, not what — the diff already shows what.
 ### Before opening a PR
 
 ```bash
-npm test               # Jest (7,500+ tests across 500+ suites)
-npm run lint           # ESLint
-npm run typecheck      # tsc --noEmit
-npm run lint:umlauts   # catches ASCII umlaut substitutes in German strings
+pnpm test               # Vitest (7,500+ tests across 500+ suites)
+pnpm run lint           # ESLint
+pnpm run typecheck      # tsc --noEmit
+pnpm run lint:umlauts   # catches ASCII umlaut substitutes in German strings
 ```
 
 CI re-runs all of these. PRs blocked by failing CI will not be merged.
@@ -69,7 +69,7 @@ These are the rules the codebase actually relies on. Violations either fail CI o
 | Use `TABLE_NAMES` from `@/config/database` — never hardcode table strings | One source of truth; renaming a table is one diff |
 | Parameterized queries only — never string-concatenate user input | SQL injection |
 | Use `CONTACT` / `ORG` / `LOCATIONS` from `@/config/org` — never hardcode addresses, phones, emails | Same SSOT principle, applied to org-level data |
-| Swiss German: `ss` (not `ß`), proper `ä/ö/ü` (never `ae/oe/ue`) | Project locale standard; `npm run lint:umlauts` enforces it |
+| Swiss German: `ss` (not `ß`), proper `ä/ö/ü` (never `ae/oe/ue`) | Project locale standard; `pnpm run lint:umlauts` enforces it |
 | Wrap multi-statement writes in `db.transaction(...)` with explicit `FOR UPDATE` when needed | Concurrency safety — TOCTOU races cost us real bugs in 2026-Q1 |
 | Mobile-first responsive Tailwind, 44×44 minimum tap targets | Most users land on phones |
 
diff --git a/README.md b/README.md
index ecadafc1d..414930a4e 100644
--- a/README.md
+++ b/README.md
@@ -89,13 +89,13 @@ These are enforced, not suggested:
 - **Logger** -- `import { logger } from '@/lib/logger'`. Never `console.log`.
 - **TABLE_NAMES** -- never hardcoded table strings. Import from `src/config/database.ts`.
 - **Parameterized queries** -- never string concatenation. No exceptions.
-- **Swiss German** -- user-facing text uses `ss` (not `ß`), proper `ä/ö/ü` (never `ae/oe/ue`). `npm run lint:umlauts` catches violations.
+- **Swiss German** -- user-facing text uses `ss` (not `ß`), proper `ä/ö/ü` (never `ae/oe/ue`). `pnpm run lint:umlauts` catches violations.
 
 ## Tech Stack
 
 | Layer | Technology |
 |-------|------------|
-| Framework | Next.js 16 (App Router), React 19, TypeScript 5, Tailwind 4 |
+| Framework | Next.js 16 (App Router), React 19, TypeScript 6, Tailwind 4 |
 | Database | PostgreSQL (prod: Hetzner self-hosted; dev: Docker 5433), Drizzle ORM |
 | Auth | NextAuth v5 (Auth.js) + @auth/pg-adapter (shares the app `DATABASE_URL` pool) |
 | Search | Meilisearch |
@@ -104,7 +104,7 @@ These are enforced, not suggested:
 | Storage | Cloudflare R2 (S3-compatible) for product/listing images |
 | Rate limiting | Redis (upstash) |
 | AI | HIRN (in-house provider stack: Groq → OpenRouter → Ollama cascade) |
-| Testing | Jest (7,500+ tests), Playwright (E2E) |
+| Testing | Vitest (7,500+ tests), Playwright (E2E) |
 | CI/CD | GitHub Actions → self-hosted Hetzner deploy (systemd `revampit-app`) |
 
 <details>
@@ -112,8 +112,8 @@ These are enforced, not suggested:
 
 ### Prerequisites
 
-- Node.js 20+
-- A PostgreSQL database — local Docker via `npm run services:up` (port 5433)
+- Node.js 22.13+ (CI and deploy run Node 24)
+- A PostgreSQL database — local Docker via `pnpm run services:up` (port 5433)
 - Optional: Meilisearch, Redis, Listmonk for full feature coverage
 
 ### Setup
@@ -122,9 +122,9 @@ These are enforced, not suggested:
 git clone https://github.com/bitbaum/evig.git
 cd evig
 cp .env.example .env.local    # fill in DATABASE_URL, AUTH_SECRET, payment keys, etc.
-npm install
-npm run db:migrate
-npm run dev                    # Next.js on :3000
+pnpm install
+pnpm run db:migrate
+pnpm run dev                    # Next.js on :3000
 ```
 
 ### Environment Variables
@@ -143,7 +143,7 @@ See `.env.example` for the full list.
 
 ## Testing
 
-7,500+ tests across 500+ Jest suites, plus a Playwright E2E layer.
+7,500+ tests across 500+ Vitest suites, plus a Playwright E2E layer.
 
 | Category | Coverage |
 |----------|----------|
@@ -155,8 +155,8 @@ See `.env.example` for the full list.
 | E2E (Playwright) | Auth smoke, marketplace, IT-Hilfe, security |
 
 ```bash
-npm test              # run all Jest tests
-npm run test:e2e      # run Playwright E2E suite
+pnpm test              # run all Vitest tests
+pnpm run test:e2e      # run Playwright E2E suite
 ```
 
 ### CI Pipeline
@@ -165,7 +165,7 @@ Defined in `.github/workflows/ci.yml`:
 
 1. **Code Quality** -- ESLint + TypeScript type check + Next.js build
 2. **Auth Smoke Test** -- Playwright, runs conditionally
-3. **Unit Tests** -- Jest, PR only
+3. **Unit Tests** -- Vitest, PR only
 
 On merge to `main`, the `.github/workflows/deploy-selfhost.yml` workflow lints, type-checks, builds the Next standalone bundle, rsyncs it to the Hetzner box, and restarts the systemd `revampit-app` service (with a page-render rollback gate). Vercel is not used for production.
 
@@ -192,7 +192,7 @@ src/
   db/schema/        # Drizzle schemas
 scripts/
   db/migrations/    # Sequential SQL migrations (072 ADD COLUMN token_version, etc.)
-tests/              # Jest test suites
+tests/              # Vitest test suites
 e2e/                # Playwright E2E tests
 ```
 
@@ -200,7 +200,7 @@ e2e/                # Playwright E2E tests
 
 1. Fork and create a feature branch
 2. Follow the development standards (TABLE_NAMES, logger, parameterized queries, Swiss German rules)
-3. Run `npm test` and `npm run lint:umlauts` before pushing
+3. Run `pnpm test` and `pnpm run lint:umlauts` before pushing
 4. Open a PR against `main` -- CI will validate code quality and tests
 
 ## License
diff --git a/docs/ADMIN_QUICK_REFERENCE.md b/docs/ADMIN_QUICK_REFERENCE.md
index bca010591..5d11cd476 100644
--- a/docs/ADMIN_QUICK_REFERENCE.md
+++ b/docs/ADMIN_QUICK_REFERENCE.md
@@ -4,8 +4,8 @@
 
 ### One-Command Setup
 ```bash
-npm run d              # Start all services
-npm run setup-admins   # Create admin users
+pnpm run d              # Start all services
+pnpm run setup-admins   # Create admin users
 ```
 
 ### Access Points
@@ -20,8 +20,8 @@ npm run setup-admins   # Create admin users
 
 ### Start/Stop Services
 ```bash
-npm run d              # Start everything
-npm run stop:all       # Stop all services
+pnpm run d              # Start everything
+pnpm run stop:all       # Stop all services
 ```
 
 ### Monitor System
@@ -68,12 +68,12 @@ Click any button to copy the command to clipboard:
 ```bash
 docker ps                    # Check if containers are running
 docker compose down         # Clean restart
-npm run d                   # Restart all
+pnpm run d                   # Restart all
 ```
 
 ### Can't Access Admin
 ```bash
-npm run setup-admins        # Recreate admin users
+pnpm run setup-admins        # Recreate admin users
 # Check credentials above
 ```
 
@@ -85,7 +85,7 @@ npm run setup-admins        # Recreate admin users
 ### Database Issues
 ```bash
 docker compose down -v      # Remove volumes (⚠️ loses data)
-npm run reset              # Full system reset
+pnpm run reset              # Full system reset
 ```
 
 ## 📞 Support
diff --git a/docs/AI_BOT_SYSTEM_PROMPT.md b/docs/AI_BOT_SYSTEM_PROMPT.md
index fe2d6e235..9dce79827 100644
--- a/docs/AI_BOT_SYSTEM_PROMPT.md
+++ b/docs/AI_BOT_SYSTEM_PROMPT.md
@@ -69,7 +69,7 @@
 **Beschreibung**: Professionelle Webentwicklung mit modernen Open-Source-Technologien.
 
 **Technologie-Stack**:
-- Frontend: Next.js 14+, React 18, TypeScript, Tailwind CSS
+- Frontend: Next.js 16, React 19, TypeScript, Tailwind CSS
 - CMS: Headless CMS (Strapi, Payload, Tina)
 - E-Commerce: WooCommerce, Shopware 6 Integration
 
diff --git a/docs/BEST_PRACTICES.md b/docs/BEST_PRACTICES.md
index d137e6a05..0e29ce117 100644
--- a/docs/BEST_PRACTICES.md
+++ b/docs/BEST_PRACTICES.md
@@ -133,10 +133,10 @@ grep -r "function.*name" src/ | sort | uniq -d
 find src/ -type f -name "*.tsx" | sort
 
 # Find unused imports (requires tools like ts-prune)
-npx ts-prune
+pnpm dlx ts-prune
 
 # Find duplicate code blocks
-npx jscpd src/
+pnpm dlx jscpd src/
 
 # Check for conflicting exports
 grep -r "export.*from" src/ | sort
diff --git a/docs/BLOG_SYSTEM.md b/docs/BLOG_SYSTEM.md
index 617e5da28..2ddd7120f 100644
--- a/docs/BLOG_SYSTEM.md
+++ b/docs/BLOG_SYSTEM.md
@@ -11,7 +11,7 @@ The RevampIt blog is a **git-based, TinaCMS-powered blogging system** with user-
 - **Content Format**: Markdown with frontmatter
 - **Storage**: File system (no database needed)
 - **Styling**: Tailwind CSS (Medium-inspired)
-- **Framework**: Next.js 14 (App Router)
+- **Framework**: Next.js 16 (App Router)
 
 ## File Structure
 
@@ -72,7 +72,7 @@ Each component has a single responsibility:
 
 1. **Using TinaCMS**:
    ```bash
-   npm run dev
+   pnpm run dev
    # Visit http://localhost:3000/admin
    # Click "Posts" → "Create new post"
    ```
diff --git a/docs/COMMANDS.md b/docs/COMMANDS.md
index 410a2a680..b9b8b5c25 100644
--- a/docs/COMMANDS.md
+++ b/docs/COMMANDS.md
@@ -6,18 +6,18 @@ last_modified_summary: IT-Hilfe journey E2E (edit + withdraw); local run notes
 
 # RevampIT Commands Reference (SSOT)
 
-**Single Source of Truth** for all npm scripts and commands.
+**Single Source of Truth** for all package scripts and commands.
 
 ---
 
 ## Quick Start Commands
 
 ```bash
-npm run d              # Start everything (databases + dev server)
-npm run dev            # Frontend only (port 3000)
-npm run services:up    # Start Docker services (db, redis, meilisearch)
-npm run services:down  # Stop Docker services
-npm run setup-admins   # Create admin users
+pnpm run d              # Start everything (databases + dev server)
+pnpm run dev            # Frontend only (port 3000)
+pnpm run services:up    # Start Docker services (db, meilisearch, listmonk)
+pnpm run services:down  # Stop Docker services
+pnpm run setup-admins   # Create admin users
 ```
 
 ---
@@ -25,8 +25,7 @@ npm run setup-admins   # Create admin users
 ## Development Commands
 
 ```bash
-npm run dev            # Start Next.js dev server (port 3000)
-npm run dev:cms        # Start CMS (currently disabled)
+pnpm run dev            # Start Next.js dev server (port 3000)
 ```
 
 ---
@@ -34,12 +33,12 @@ npm run dev:cms        # Start CMS (currently disabled)
 ## Docker Services
 
 ```bash
-npm run services:up    # Start all services (db, redis, meilisearch)
-npm run services:down  # Stop all services
-npm run db:up          # Start main database only
-npm run db:down        # Stop main database
-npm run setup          # Start database and wait 5 seconds
-npm run reset          # Stop all, remove volumes, and reset
+pnpm run services:up    # Start all services (db, meilisearch, listmonk)
+pnpm run services:down  # Stop all services
+pnpm run db:up          # Start main database only
+pnpm run db:down        # Stop main database
+pnpm run setup          # Start database and wait 5 seconds
+pnpm run reset          # Stop all, remove volumes, and reset
 ```
 
 ---
@@ -47,11 +46,11 @@ npm run reset          # Stop all, remove volumes, and reset
 ## Build & Production
 
 ```bash
-npm run build          # Production build (Next.js + sitemap)
-npm run start          # Start production server
-npm run typecheck      # TypeScript validation (run before commits!)
-npm run lint           # ESLint check
-npm run i18n:businessplan  # Business plan i18n shape/invariant parity (8 locales)
+pnpm run build          # Production build (Next.js + sitemap)
+pnpm run start          # Start production server
+pnpm run typecheck      # TypeScript validation (run before commits!)
+pnpm run lint           # ESLint check
+pnpm run i18n:businessplan  # Business plan i18n shape/invariant parity (8 locales)
 ```
 
 ### Monitor-Upcycling content scripts
@@ -68,28 +67,28 @@ See `docs/projects/upcycling.md` for mini-site SSOT map.
 ## Testing
 
 ```bash
-npm run test           # Jest unit tests
-npm run test:watch     # Jest watch mode
-npm run test:coverage  # Jest with coverage
-npm run test:e2e       # Playwright E2E tests
-npm run test:e2e:auth  # Auth login smoke (needs AUTH_TEST_EMAIL/PASSWORD)
-npm run test:e2e:inventory # Dual-persona feature inventory (user + admin)
-npm run test:e2e:inventory:prod # Same, with prod health wait (CI / post-deploy)
-npm run test:e2e:user-admin # Legacy quick smoke (subset)
-npm run test:e2e:it-hilfe    # IT-Hilfe hub/journey specs
-npm run test:e2e:it-hilfe:journey # Dual-persona lifecycle + edit/withdraw (see E2E section)
-npm run test:e2e:marketplace:journey # User sells, admin buys (Payrexx when configured)
-npm run test:e2e:workshops:proposal:journey # User proposes, admin approve/reject
-npm run test:e2e:timecards:journey          # Staff submit + admin approve (TIME round-trip)
-npm run test:e2e:intake:journey             # Admin intake create → checklist → publish
-npm run test:e2e:tasks:journey              # Admin task create → complete
-npm run test:e2e:protocols:journey          # Admin protocol create → JSON import → finalize
-npm run test:e2e:decisions:journey          # Admin decision create → vote → close
-npm run test:e2e:cms:journey                # Admin blog draft → publish → public view
-npm run test:e2e:it-hilfe:preferred:journey # Request with preferred techniker
-npm run test:e2e:service:journey # User books repair, admin assigns techniker (dual-persona)
-npm run test:e2e:ui    # Playwright with UI
-npm run test:all       # Run all tests
+pnpm run test           # Vitest unit tests
+pnpm run test:watch     # Vitest watch mode
+pnpm run test:coverage  # Vitest with coverage
+pnpm run test:e2e       # Playwright E2E tests
+pnpm run test:e2e:auth  # Auth login smoke (needs AUTH_TEST_EMAIL/PASSWORD)
+pnpm run test:e2e:inventory # Dual-persona feature inventory (user + admin)
+pnpm run test:e2e:inventory:prod # Same, with prod health wait (CI / post-deploy)
+pnpm run test:e2e:user-admin # Legacy quick smoke (subset)
+pnpm run test:e2e:it-hilfe    # IT-Hilfe hub/journey specs
+pnpm run test:e2e:it-hilfe:journey # Dual-persona lifecycle + edit/withdraw (see E2E section)
+pnpm run test:e2e:marketplace:journey # User sells, admin buys (Payrexx when configured)
+pnpm run test:e2e:workshops:proposal:journey # User proposes, admin approve/reject
+pnpm run test:e2e:timecards:journey          # Staff submit + admin approve (TIME round-trip)
+pnpm run test:e2e:intake:journey             # Admin intake create → checklist → publish
+pnpm run test:e2e:tasks:journey              # Admin task create → complete
+pnpm run test:e2e:protocols:journey          # Admin protocol create → JSON import → finalize
+pnpm run test:e2e:decisions:journey          # Admin decision create → vote → close
+pnpm run test:e2e:cms:journey                # Admin blog draft → publish → public view
+pnpm run test:e2e:it-hilfe:preferred:journey # Request with preferred techniker
+pnpm run test:e2e:service:journey # User books repair, admin assigns techniker (dual-persona)
+pnpm run test:e2e:ui    # Playwright with UI
+pnpm run test:all       # Run all tests
 ```
 
 ---
@@ -124,38 +123,38 @@ Requires `.env.selfhost.local` locally (gitignored). Copy from a teammate or rec
 **Local marketplace journey (no prod secrets):**
 
 ```bash
-npm run e2e:seed
+pnpm run e2e:seed
 PLAYWRIGHT_CHANNEL=chrome \
 AUTH_TEST_USER_EMAIL=e2e-user@revampit.test AUTH_TEST_USER_PASSWORD='E2EUser123!' \
 AUTH_TEST_ADMIN_EMAIL=e2e-admin@revampit.test AUTH_TEST_ADMIN_PASSWORD='E2EAdmin123!' \
-npm run test:e2e:marketplace:journey
+pnpm run test:e2e:marketplace:journey
 ```
 
 **Local IT-Hilfe dual-persona journey** (owner edit + withdraw offer + full lifecycle):
 
 ```bash
-npm run e2e:seed
+pnpm run e2e:seed
 PLAYWRIGHT_CHANNEL=chrome PLAYWRIGHT_BASE_URL=http://localhost:3001 \
 AUTH_TEST_USER_EMAIL=e2e-user@revampit.test AUTH_TEST_USER_PASSWORD='E2EUser123!' \
 AUTH_TEST_ADMIN_EMAIL=e2e-admin@revampit.test AUTH_TEST_ADMIN_PASSWORD='E2EAdmin123!' \
-npm run test:e2e:it-hilfe:journey
+pnpm run test:e2e:it-hilfe:journey
 ```
 
-Use `npx next dev --port 3001 --webpack` locally if Turbopack returns 404 on `/api/auth/*`. Restart the dev server if create-request rate limit (`Zu viele Anfragen`) trips during repeated runs.
+Use `pnpm exec next dev --port 3001 --webpack` locally if Turbopack returns 404 on `/api/auth/*`. Restart the dev server if create-request rate limit (`Zu viele Anfragen`) trips during repeated runs.
 
-Apply migration `114_listing_questions.sql` before first local run (`npm run db:migrate` or direct `psql`). **Prod:** applied on Hetzner 2026-07-04 (see `docs/FEATURE_INVENTORY.md` → Marketplace UX rollout tracker).
+Apply migration `114_listing_questions.sql` before first local run (`pnpm run db:migrate` or direct `psql`). **Prod:** applied on Hetzner 2026-07-04 (see `docs/FEATURE_INVENTORY.md` → Marketplace UX rollout tracker).
 
-After each successful deploy, **Dual-persona inventory smoke** runs automatically when the two password secrets are set (routes + IT-Hilfe + marketplace + workshops + service journeys). Manual re-run: `npm run test:e2e:inventory:prod`.
+After each successful deploy, **Dual-persona inventory smoke** runs automatically when the two password secrets are set (routes + IT-Hilfe + marketplace + workshops + service journeys). Manual re-run: `pnpm run test:e2e:inventory:prod`.
 
 Payrexx go-live checklist: `docs/operations/PAYREXX_SETUP.md` · config SSOT: `src/config/payrexx.ts`.
 
 ### Manual
 
 ```bash
-npm run deploy          # same as deploy:selfhost
-npm run deploy:selfhost # build standalone → release backup → activate → /api/health gate → rollback on failure
-npm run ship            # quality gate (typecheck, lint, build, tests)
-npm run db:migrate      # apply unrecorded scripts/db/migrations/*.sql (DATABASE_URL / PG* env)
+pnpm run deploy          # same as deploy:selfhost
+pnpm run deploy:selfhost # build standalone → release backup → activate → /api/health gate → rollback on failure
+pnpm run ship            # quality gate (typecheck, lint, build, tests)
+pnpm run db:migrate      # apply unrecorded scripts/db/migrations/*.sql (DATABASE_URL / PG* env)
 ```
 
 Operational checks:
@@ -179,7 +178,7 @@ The deploy script copies the server-local `.env` and `launch.sh` into each relea
 ## Database
 
 ```bash
-npm run db:migrate-users  # Migrate existing users
+pnpm run db:migrate-users  # Migrate existing users
 ```
 
 ---
@@ -187,13 +186,13 @@ npm run db:migrate-users  # Migrate existing users
 ## Production Docker
 
 ```bash
-npm run prod:build     # Build production Docker image
-npm run prod:up        # Start production containers
-npm run prod:down      # Stop production containers
+pnpm run prod:build     # Build production Docker image
+pnpm run prod:up        # Start production containers
+pnpm run prod:down      # Stop production containers
 ```
 
 ---
 
-**Last Updated**: 2026-06-19  
+**Last Updated**: 2026-09-04  
 **Last Modified Summary**: Post-deploy dual-persona inventory in GitHub Actions; E2E secret docs.  
 **Source**: `package.json`
diff --git a/docs/DESIGN_SYSTEM.md b/docs/DESIGN_SYSTEM.md
index 9ecfa5030..7a5920e42 100644
--- a/docs/DESIGN_SYSTEM.md
+++ b/docs/DESIGN_SYSTEM.md
@@ -148,7 +148,7 @@ Updated 2026-06-15 after OrangeCat/FleetCrown audit + Phase 0 SSOT migration:
 | **Phase 5** — Admin/dashboard sweep | done 2026-06-15 | Dashboard cards → `card-shell`; overlays → `shadow-xs`; chart tooltips migrated |
 | **Phase 6** — Raw control migration | done 2026-06-15 | Primitives only in feature code; ESLint design rules → **error** project-wide |
 
-Run `npm run lint` to see palette-class warnings (new rules as of 2026-06-15).
+Run `pnpm run lint` to see palette-class warnings (new rules as of 2026-06-15).
 
 ### RevampIT vs OrangeCat — key differences
 
diff --git a/docs/EMAIL_SETUP.md b/docs/EMAIL_SETUP.md
index 32eb73d8e..4370a3859 100644
--- a/docs/EMAIL_SETUP.md
+++ b/docs/EMAIL_SETUP.md
@@ -35,7 +35,7 @@ This guide shows you how to configure email sending for development and producti
 
 4. **Test the configuration**:
    ```bash
-   npm run dev
+   pnpm run dev
    # Try registering a new user
    # Check your inbox for verification code
    ```
@@ -291,7 +291,7 @@ node --loader tsx test-email.js
 
 1. **Start dev server**:
    ```bash
-   npm run dev
+   pnpm run dev
    ```
 
 2. **Register a new user**:
diff --git a/docs/HIRN_AI.md b/docs/HIRN_AI.md
index 31cb422df..0b905ce02 100644
--- a/docs/HIRN_AI.md
+++ b/docs/HIRN_AI.md
@@ -134,13 +134,13 @@ OLLAMA_EMBEDDING_MODEL=nomic-embed-text
 
 ```bash
 # Alle Docs indexieren
-npx tsx scripts/hirn-ingest.ts --dir ./docs
+pnpm exec tsx scripts/hirn-ingest.ts --dir ./docs
 
 # Einzelne Datei
-npx tsx scripts/hirn-ingest.ts --file ./README.md
+pnpm exec tsx scripts/hirn-ingest.ts --file ./README.md
 
 # Stats anzeigen
-npx tsx scripts/hirn-ingest.ts --stats
+pnpm exec tsx scripts/hirn-ingest.ts --stats
 ```
 
 ## API Endpoints
diff --git a/docs/HR_RUNBOOK.md b/docs/HR_RUNBOOK.md
index c62073225..357e59e61 100644
--- a/docs/HR_RUNBOOK.md
+++ b/docs/HR_RUNBOOK.md
@@ -156,7 +156,7 @@ erstellen** on the report to mint a public `/r/<token>` link — view + print, n
 Open applications older than **365 days** (`HR_APPLICATION_RETENTION_DAYS`) can be closed by:
 
 ```bash
-npx tsx scripts/maintenance/hr-application-retention.ts
+pnpm exec tsx scripts/maintenance/hr-application-retention.ts
 ```
 
 Schedule via cron on production if desired.
@@ -183,7 +183,7 @@ Schedule via cron on production if desired.
 ## E2E verification
 
 ```bash
-npm run test -- src/lib/schemas/__tests__/hr-vacancies.test.ts
+pnpm run test src/lib/schemas/__tests__/hr-vacancies.test.ts
 # Full journey (needs auth env + DB):
-npm run test:e2e -- tests/e2e/hr-vacancy-journey.spec.ts
+pnpm run test:e2e -- tests/e2e/hr-vacancy-journey.spec.ts
 ```
diff --git a/docs/IMPROVEMENT_PLAN.md b/docs/IMPROVEMENT_PLAN.md
index 1f80a8264..f993601e9 100644
--- a/docs/IMPROVEMENT_PLAN.md
+++ b/docs/IMPROVEMENT_PLAN.md
@@ -130,5 +130,5 @@ One assistant, one brand: **Hirn**, on both surfaces. What changed:
 ---
 
 ## Verification gate (every batch)
-`npm run typecheck` + `npm run lint` + `npm test` + `npm run lint:umlauts` green;
+`pnpm run typecheck` + `pnpm run lint` + `pnpm test` + `pnpm run lint:umlauts` green;
 deploy via push-to-main → GH Actions; verify key pages live on prod (public + admin).
diff --git a/docs/MIGRATIONS.md b/docs/MIGRATIONS.md
index 7a69c13b3..3b00a77f8 100644
--- a/docs/MIGRATIONS.md
+++ b/docs/MIGRATIONS.md
@@ -57,7 +57,7 @@ Drizzle Kit itself remains installed (`drizzle-kit` in devDependencies) — it's
 
 3. **Update the Drizzle schema in `src/db/schema/*.ts`** to mirror the migration. This is what TypeScript code reads — the two must stay in sync. Forgetting this is the most common foot-gun.
 
-4. **Run locally:** `npm run db:up` (starts the Docker Postgres), then `bash scripts/db/run-migration.sh`. The runner shows `applied: N · skipped: M` at the end; new migrations should appear in the applied count.
+4. **Run locally:** `pnpm run db:up` (starts the Docker Postgres), then `bash scripts/db/run-migration.sh`. The runner shows `applied: N · skipped: M` at the end; new migrations should appear in the applied count.
 
 5. **Apply to production — automatic on deploy.** Production runs a self-hosted
    Postgres 17 on the Hetzner box (`DATABASE_URL=postgresql://…@localhost:5432/revampit`).
diff --git a/docs/RELIABILITY.md b/docs/RELIABILITY.md
index 63d78ca55..3f2fa373d 100644
--- a/docs/RELIABILITY.md
+++ b/docs/RELIABILITY.md
@@ -24,7 +24,7 @@ This project is configured to favor reliability of Auth and Database while keepi
 ## How to run migrations
 
 ```
-npm run db:up
+pnpm run db:up
 bash scripts/db/run-migration.sh
 ```
 
diff --git a/docs/SHARED_CONTEXT.md b/docs/SHARED_CONTEXT.md
index 579f0b4e2..6544f8375 100644
--- a/docs/SHARED_CONTEXT.md
+++ b/docs/SHARED_CONTEXT.md
@@ -46,7 +46,7 @@ jurisdiction, letterhead) takes it from `ORG` in that file.
 
 | Environment | Host | Port | Database | Notes |
 |-------------|------|------|----------|-------|
-| **Local dev** | `localhost` | 5433 | `revampit_cms` | `npm run services:up` (Docker) |
+| **Local dev** | `localhost` | 5433 | `revampit_cms` | `pnpm run services:up` (Docker) |
 | **Production** | `localhost` (on box) | 5432 | `revampit` | Hetzner self-hosted; ops via SSH tunnel — see `.env.selfhost.local.example` |
 
 **SSOT:** `DATABASE_URL` only. No `AUTH_DB_*` split.
diff --git a/docs/TEAM_TRANSPARENCY_PLAN.md b/docs/TEAM_TRANSPARENCY_PLAN.md
index da7744510..c9114eab9 100644
--- a/docs/TEAM_TRANSPARENCY_PLAN.md
+++ b/docs/TEAM_TRANSPARENCY_PLAN.md
@@ -204,9 +204,9 @@ Pure wiring of existing `tasks` + `team_profiles` + `activity_updates`.
 - SQL: `TABLE_NAMES` + parameterized only. Drizzle `sql` tag → `sql.raw(TABLE_NAMES.X)` for identifiers.
 - Permissions: gate every API with `withAdmin('<section>')`; the `team` section is **sensitive** (super-admin/explicit grant) — decide whether the board is `team`-sensitive or a new less-sensitive `team-board` id. Recommend: board readable by any staff (transparency is the point), HR/compensation stays in the sensitive `team` detail.
 - Design: semantic tokens + shared primitives (`Card`, `Button`, `Heading`, `IconBadge`, `Section`, `AdminTable`). No arbitrary hex, no `shadow-lg/xl` on cards, green only for CTA/focus/sustainability. `grep -rn '\[#' src/` stays empty.
-- i18n: all user-facing strings → message keys (DE canonical). Structure/enums → config, not messages. Run `npm run compliance:i18n`.
+- i18n: all user-facing strings → message keys (DE canonical). Structure/enums → config, not messages. Run `pnpm run compliance:i18n`.
 - Migrations reach PROD via `scripts/db/migrations/` only; replay from zero locally first.
-- Before done: `npm run typecheck`, `npm run lint`, `npm run lint:umlauts`, relevant tests.
+- Before done: `pnpm run typecheck`, `pnpm run lint`, `pnpm run lint:umlauts`, relevant tests.
 
 ---
 
diff --git a/docs/TRANSLATION.md b/docs/TRANSLATION.md
index ee5bd4a90..aa95f509a 100644
--- a/docs/TRANSLATION.md
+++ b/docs/TRANSLATION.md
@@ -19,7 +19,7 @@ The admin area follows the user's language preference (NEXT_LOCALE cookie, switc
 
 ```bash
 # 1. Generate per-locale "missing keys" inventory
-npm run i18n:missing
+pnpm run i18n:missing
 # → writes messages/_missing/<locale>.json (gitignored)
 
 # 2. Send the file to a translator. Format is:
@@ -27,7 +27,7 @@ npm run i18n:missing
 #    Translator fills in every "translation" string.
 
 # 3. Merge translations back:
-#    npm run i18n:apply <locale>
+#    pnpm run i18n:apply <locale>
 #    → safe: never overwrites existing non-empty values; surfaces conflicts
 #      (existing differs from candidate) for manual review.
 ```
@@ -48,8 +48,8 @@ Generated by namespace, biggest user-impact first:
 Translator returns a filled-in `messages/_missing/<locale>.json`. Merge:
 
 ```bash
-npm run i18n:apply <locale>
-npm run i18n:missing      # verify count dropped
+pnpm run i18n:apply <locale>
+pnpm run i18n:missing      # verify count dropped
 ```
 
 Apply-script behavior:
@@ -79,7 +79,7 @@ If budget allows only one: **EN** (lowest count, widest reader base). If two: EN
 
 ## Detection over time
 
-`scripts/i18n-audit.mjs` already exists and runs as part of `npm run compliance`. Pipe it into CI so a new key added in DE without a fallback plan surfaces immediately.
+`scripts/i18n-audit.mjs` already exists and runs as part of `pnpm run compliance`. Pipe it into CI so a new key added in DE without a fallback plan surfaces immediately.
 
 ---
 
diff --git a/docs/UNIFIED_AUTH.md b/docs/UNIFIED_AUTH.md
index 2cb54819e..a97897030 100644
--- a/docs/UNIFIED_AUTH.md
+++ b/docs/UNIFIED_AUTH.md
@@ -130,7 +130,7 @@ Also used by IT-Hilfe anonymous-post claim flow (password-set link for unclaimed
 
 **Unverified existing account at register:** `registerUser()` resumes setup (updates password, resends 6-digit code) instead of blocking with "account exists".
 
-**Ops unlock:** `npx tsx scripts/dev/auth-unlock-user.ts <email> --verify-email` (see script header).
+**Ops unlock:** `pnpm exec tsx scripts/dev/auth-unlock-user.ts <email> --verify-email` (see script header).
 
 ### 5. Onboarding (dashboard)
 
diff --git a/docs/development/DEV_GUIDE.md b/docs/development/DEV_GUIDE.md
index ac67d1624..1e589f487 100644
--- a/docs/development/DEV_GUIDE.md
+++ b/docs/development/DEV_GUIDE.md
@@ -977,21 +977,21 @@ const { data } = await supabase.from(PRODUCT_TABLE).select('*');
 
 ```bash
 # Development
-npm run dev              # Start dev server
-npm run dev:full         # Start all services
-npm run d                # Alias for dev:full
-npm run build            # Build for production
-npm run test             # Run tests
-npm run test:e2e         # Run E2E tests
-npm run lint             # Run linter
+pnpm run dev              # Start dev server
+pnpm run dev:full         # Start all services
+pnpm run d                # Alias for dev:full
+pnpm run build            # Build for production
+pnpm run test             # Run tests
+pnpm run test:e2e         # Run E2E tests
+pnpm run lint             # Run linter
 
 # Database
-npm run db:up            # Start database
-npm run db:down           # Stop database
-npm run services:up       # Start all Docker services
+pnpm run db:up            # Start database
+pnpm run db:down           # Stop database
+pnpm run services:up       # Start all Docker services
 
 # CMS API
-cd cms-api && npm run dev # Start CMS API server
+cd cms-api && pnpm run dev # Start CMS API server
 
 # Git
 git checkout -b feature/name  # Create feature branch
diff --git a/docs/development/claude.md b/docs/development/claude.md
index b26bb4657..52a10acee 100644
--- a/docs/development/claude.md
+++ b/docs/development/claude.md
@@ -460,16 +460,16 @@ Provide complete implementation with error handling."
 "Verify the implementation:
 
 1. TypeScript compilation:
-   npm run build
+   pnpm run build
 
 2. Linting:
-   npm run lint
+   pnpm run lint
 
 3. Tests:
-   npm run test
+   pnpm run test
 
 4. Manual testing:
-   npm run dev
+   pnpm run dev
    # Test in browser
 
 5. Code review checklist:
@@ -493,8 +493,8 @@ Provide complete implementation with error handling."
    - Check all usages updated
 
 2. Code quality:
-   - npm run lint
-   - npm run build
+   - pnpm run lint
+   - pnpm run build
    - Check for regressions
 
 3. Documentation:
diff --git a/docs/development/cursor.md b/docs/development/cursor.md
index d4e31936f..c8fe155a7 100644
--- a/docs/development/cursor.md
+++ b/docs/development/cursor.md
@@ -90,9 +90,9 @@ grep: ProductCard
 **Use terminal for verification:**
 ```bash
 # After creating files, verify they work
-npm run lint
-npm run build
-npm run test
+pnpm run lint
+pnpm run build
+pnpm run test
 
 # Check git status
 git status
@@ -388,7 +388,7 @@ logger.debug('Debug info', { data });
 
 ```typescript
 // 1. Start dev server
-run_terminal_cmd: npm run dev
+run_terminal_cmd: pnpm run dev
 
 // 2. Navigate to page
 browser_navigate: http://localhost:3000/products
@@ -407,13 +407,13 @@ browser_snapshot
 
 ```bash
 # Run tests
-npm run test
+pnpm run test
 
 # Run linter
-npm run lint
+pnpm run lint
 
 # Check build
-npm run build
+pnpm run build
 
 # Check services
 docker compose ps
@@ -427,11 +427,11 @@ docker compose ps
 
 ```bash
 # Development
-npm run dev              # Start dev server
-npm run d                # Start all services
-npm run lint             # Check code quality
-npm run test             # Run tests
-npm run build            # Build for production
+pnpm run dev              # Start dev server
+pnpm run d                # Start all services
+pnpm run lint             # Check code quality
+pnpm run test             # Run tests
+pnpm run build            # Build for production
 
 # Git
 git status               # Check changes
diff --git a/docs/development/gemini.md b/docs/development/gemini.md
index 4117291d8..475b6d616 100644
--- a/docs/development/gemini.md
+++ b/docs/development/gemini.md
@@ -168,8 +168,8 @@ function processProducts(products: Product[]): ProcessedProduct[] {
 ```typescript
 // ✅ GOOD: Request verification
 "After implementing this, what commands should I run to verify it works?
-- npm run lint?
-- npm run test?
+- pnpm run lint?
+- pnpm run test?
 - curl http://localhost:3000/api/endpoint?"
 ```
 
@@ -421,16 +421,16 @@ export async function GET(request: NextRequest) {
 
 ```bash
 # 1. Check TypeScript compilation
-npm run build
+pnpm run build
 
 # 2. Check linting
-npm run lint
+pnpm run lint
 
 # 3. Run tests
-npm run test
+pnpm run test
 
 # 4. Test manually
-npm run dev
+pnpm run dev
 # Then test in browser
 
 # 5. Check for console errors
diff --git a/docs/guides/ARCHITECTURE.md b/docs/guides/ARCHITECTURE.md
index 0d95b92ed..1ca9d0d5a 100644
--- a/docs/guides/ARCHITECTURE.md
+++ b/docs/guides/ARCHITECTURE.md
@@ -20,7 +20,7 @@ RevampIT uses a modern, scalable architecture designed for sustainability, perfo
 
 ## Technology Stack
 
-### Frontend: Next.js 14
+### Frontend: Next.js 16
 - **Framework**: Next.js with App Router
 - **Language**: TypeScript
 - **Styling**: Tailwind CSS
@@ -209,12 +209,12 @@ Backend Server
 
 ### Getting Started
 1. Clone repository
-2. Install dependencies (`npm install`)
+2. Install dependencies (`pnpm install`)
 3. Set up environment variables
 4. Start PostgreSQL database
 5. Run migrations
-6. Start CMS API (`npm run dev` in cms-api/)
-7. Start frontend (`npm run dev`)
+6. Start CMS API (`pnpm run dev` in cms-api/)
+7. Start frontend (`pnpm run dev`)
 
 ### Making Changes
 1. Create feature branch
diff --git a/docs/guides/BACKEND_CONTENT_MANAGEMENT.md b/docs/guides/BACKEND_CONTENT_MANAGEMENT.md
index 4f3717042..e179ecc1a 100644
--- a/docs/guides/BACKEND_CONTENT_MANAGEMENT.md
+++ b/docs/guides/BACKEND_CONTENT_MANAGEMENT.md
@@ -305,8 +305,8 @@ git clone https://github.com/g-but/revampit.git
 cd revampit
 
 # 2. Install dependencies
-npm install
-cd cms-api && npm install && cd ..
+pnpm install
+cd cms-api && pnpm install && cd ..
 
 # 3. Set up environment
 cp .env.example .env.local
@@ -316,10 +316,10 @@ cp cms-api/.env.example cms-api/.env
 docker-compose up -d postgres
 
 # 5. Start CMS API (Terminal 1)
-cd cms-api && npm run dev
+cd cms-api && pnpm run dev
 
 # 6. Start frontend (Terminal 2)  
-npm run dev
+pnpm run dev
 
 # 7. Access admin interface
 open http://localhost:3000/admin/login
diff --git a/docs/guides/deployment.md b/docs/guides/deployment.md
index 81f4d8f9b..e1d893e3f 100644
--- a/docs/guides/deployment.md
+++ b/docs/guides/deployment.md
@@ -1,7 +1,7 @@
 # RevampIT Deployment Guide
 
 **Created:** 2024-12-29
-**Last Updated:** 2026-06-19
+**Last Updated:** 2026-09-04
 **Summary:** Production deploys run via GitHub Actions → Hetzner self-host. Vercel is retired.
 
 Production runs on a **self-hosted Next.js standalone build on a Hetzner box**
@@ -20,7 +20,7 @@ Developer
    │  git push origin main
    ▼
 GitHub Actions  (.github/workflows/deploy-selfhost.yml)
-   │  npm ci → npm run lint → npm run typecheck
+   │  pnpm install --frozen-lockfile → pnpm run verify
    │  write .env.selfhost.local (from SELFHOST_ENV secret)
    │  set up SSH (from HETZNER_SSH_PRIVATE_KEY secret)
    │  bash scripts/selfhost-deploy-evig.sh
@@ -57,11 +57,11 @@ Any push to `main` starts the **"Deploy production app"** workflow
 ### What GitHub Actions runs
 
 1. **Checkout** the pushed commit.
-2. **Setup Node 20** (with npm cache).
-3. **`npm ci`** — clean install.
-4. **`npm run lint`** — ESLint. A failure here fails the workflow and **nothing
+2. **Setup Node 24** (with pnpm cache).
+3. **`pnpm install --frozen-lockfile`** — clean install.
+4. **`pnpm run lint`** — ESLint. A failure here fails the workflow and **nothing
    is deployed**.
-5. **`npm run typecheck`** — TypeScript. Same: failure aborts the deploy.
+5. **`pnpm run typecheck`** — TypeScript. Same: failure aborts the deploy.
 6. **Write `.env.selfhost.local`** from the `SELFHOST_ENV` repo secret
    (`chmod 600`).
 7. **Setup SSH** from the `HETZNER_SSH_PRIVATE_KEY` repo secret, and add the
@@ -140,7 +140,7 @@ deploys. If you must deploy from a developer machine (e.g. Actions is down), and
 you have a valid `.env.selfhost.local` (gitignored) plus SSH access to the box:
 
 ```bash
-npm run deploy:selfhost
+pnpm run deploy:selfhost
 ```
 
 This runs the same `scripts/selfhost-deploy-evig.sh` locally: build →
@@ -157,8 +157,8 @@ The deploy never started — nothing changed in production. Fix locally and push
 again:
 
 ```bash
-npm run lint
-npm run typecheck
+pnpm run lint
+pnpm run typecheck
 ```
 
 ### Workflow skips with a "secrets not set" notice
diff --git a/docs/guides/hosting-migration-frauenfeld.md b/docs/guides/hosting-migration-frauenfeld.md
index caca03753..ad08ede1f 100644
--- a/docs/guides/hosting-migration-frauenfeld.md
+++ b/docs/guides/hosting-migration-frauenfeld.md
@@ -260,8 +260,8 @@ FROM base AS deps
 RUN apk add --no-cache libc6-compat
 WORKDIR /app
 
-COPY package.json package-lock.json* ./
-RUN npm ci
+COPY package.json pnpm-lock.yaml .
+RUN corepack enable pnpm && pnpm install --frozen-lockfile
 
 # Rebuild the source code only when needed
 FROM base AS builder
diff --git a/docs/guides/installation.md b/docs/guides/installation.md
index 58a5ba2a2..6ed32d635 100644
--- a/docs/guides/installation.md
+++ b/docs/guides/installation.md
@@ -6,7 +6,7 @@ This guide will help you set up the RevampIT development environment on your loc
 
 Before you begin, ensure you have the following installed:
 
-- **Node.js 18+** - [Download](https://nodejs.org/)
+- **Node.js 22.13+** - [Download](https://nodejs.org/)
 - **PostgreSQL 13+** - [Download](https://www.postgresql.org/download/)
 - **Git** - [Download](https://git-scm.com/downloads)
 - **Docker** (optional) - [Download](https://www.docker.com/get-started)
@@ -24,11 +24,11 @@ cd revampit
 
 ```bash
 # Install frontend dependencies
-npm install
+pnpm install
 
 # Install CMS API dependencies
 cd cms-api
-npm install
+pnpm install
 cd ..
 ```
 
@@ -46,7 +46,7 @@ NEXT_PUBLIC_API_URL=http://localhost:3001
 NEXT_PUBLIC_SITE_URL=http://localhost:3000
 
 # Database — DATABASE_URL is the single connection source (app + auth share this pool).
-# Local dev: Docker Postgres (npm run services:up → port 5433)
+# Local dev: Docker Postgres (pnpm run services:up → port 5433)
 DATABASE_URL=postgresql://postgres:your_password@localhost:5433/revampit_cms
 ```
 
@@ -100,7 +100,7 @@ createdb revampit_cms
 
 # Run migrations
 cd cms-api
-npm run migrate
+pnpm run migrate
 cd ..
 ```
 
@@ -111,12 +111,12 @@ Open two terminal windows:
 **Terminal 1 - CMS API:**
 ```bash
 cd cms-api
-npm run dev
+pnpm run dev
 ```
 
 **Terminal 2 - Frontend:**
 ```bash
-npm run dev
+pnpm run dev
 ```
 
 ### 6. Access the Application
@@ -172,23 +172,23 @@ psql -h localhost -p 5432 -U postgres -d revampit_cms
 
 #### Permission Issues
 ```bash
-# Fix npm permissions (Unix/Linux)
-sudo chown -R $(whoami) ~/.npm
+# Fix pnpm store permissions (Unix/Linux)
+sudo chown -R $(whoami) "$(pnpm store path)"
 
-# Clear npm cache
-npm cache clean --force
+# Prune the pnpm store
+pnpm store prune
 ```
 
 #### Module Not Found
 ```bash
 # Clear node_modules and reinstall
-rm -rf node_modules package-lock.json
-npm install
+rm -rf node_modules
+pnpm install
 
 # Also clear cms-api modules
 cd cms-api
-rm -rf node_modules package-lock.json
-npm install
+rm -rf node_modules
+pnpm install
 cd ..
 ```
 
@@ -242,7 +242,7 @@ curl http://localhost:3000
 curl http://localhost:3001/health
 
 # Check database connection
-cd cms-api && npm run db:status
+cd cms-api && pnpm run db:status
 ```
 
 ## Next Steps
diff --git a/docs/guides/migration.md b/docs/guides/migration.md
index 721e34659..c74d37311 100644
--- a/docs/guides/migration.md
+++ b/docs/guides/migration.md
@@ -67,7 +67,7 @@ node migrate-about-content.js
 
 ```bash
 # 1. Start Next.js development server
-npm run dev
+pnpm run dev
 
 # 2. Visit About page
 open http://localhost:3000/about
@@ -134,7 +134,7 @@ docker-compose up -d strapi
 curl http://localhost:1337/api/static-pages?filters[page_key][$eq]=about
 
 # Check Next.js logs
-npm run dev
+pnpm run dev
 ```
 
 ### **If you need to rollback:**
diff --git a/docs/guides/production-ready-checklist.md b/docs/guides/production-ready-checklist.md
index f459d016b..e0e2dcbcb 100644
--- a/docs/guides/production-ready-checklist.md
+++ b/docs/guides/production-ready-checklist.md
@@ -164,12 +164,12 @@ docker compose -f docker-compose.prod.yml up -d app
 ### Local Testing (before migration)
 ```bash
 # Test production build locally
-npm run prod:build
-npm run prod:up
-npm run prod:health
+pnpm run prod:build
+pnpm run prod:up
+pnpm run prod:health
 
 # Stop local production test
-npm run prod:down
+pnpm run prod:down
 ```
 
 ### Backup & Recovery
diff --git a/docs/operations/PAYREXX_SETUP.md b/docs/operations/PAYREXX_SETUP.md
index 379db32bd..d84b71c28 100644
--- a/docs/operations/PAYREXX_SETUP.md
+++ b/docs/operations/PAYREXX_SETUP.md
@@ -64,9 +64,9 @@ sudo systemctl restart revampit-app
 # E2E (full payment flows)
 AUTH_TEST_USER_PASSWORD='…' AUTH_TEST_ADMIN_PASSWORD='…' \
 PAYREXX_WEBHOOK_SECRET='…' \  # optional: simulates webhook in marketplace journey
-npm run test:e2e:marketplace:journey
-npm run test:e2e:workshops:journey
-npm run test:e2e:inventory:prod
+pnpm run test:e2e:marketplace:journey
+pnpm run test:e2e:workshops:journey
+pnpm run test:e2e:inventory:prod
 ```
 
 When configured, `isPayrexxCheckoutUnavailable()` is false on prod and checkout returns a hosted Payrexx URL instead of `PAYREXX_SETUP_MESSAGE`.
diff --git a/docs/projects/upcycling.md b/docs/projects/upcycling.md
index c3431c716..ddbaea657 100644
--- a/docs/projects/upcycling.md
+++ b/docs/projects/upcycling.md
@@ -21,7 +21,7 @@ Public sub-site at `/projects/upcycling/*` for the Monitor-Upcycling project: ex
 | Published guide slugs | `src/data/upcycling-guides.ts` |
 | Status numbers + milestones | `src/data/upcycling-status.ts` |
 | Business plan content | `messages/*.json` → `projects.upcycling.businessPlan` |
-| Business plan shape parity | `npm run i18n:businessplan` |
+| Business plan shape parity | `pnpm run i18n:businessplan` |
 
 ## Reading flow
 
@@ -46,7 +46,7 @@ Interest/newsletter band (`UpcyclingInterestBand`) is skipped on landing, busine
 ## i18n scripts
 
 ```bash
-npm run i18n:businessplan          # parity check (required before merge)
+pnpm run i18n:businessplan          # parity check (required before merge)
 node scripts/sync-businessplan-locales.mjs   # after DE businessPlan edits
 node scripts/prune-businessplan-archive.mjs  # archive stale citation keys
 ```