diff --git a/.github/workflows/docs-ci.yml b/.github/workflows/docs-ci.yml
index 646d347d..028f136a 100644
--- a/.github/workflows/docs-ci.yml
+++ b/.github/workflows/docs-ci.yml
@@ -24,16 +24,9 @@ jobs:
         with:
           submodules: 'true'
 
-      - name: install pnpm
-        uses: pnpm/action-setup@v2
-        with:
-          version: 8
-
-      - name: Set up Node.js
-        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
-        with:
-          node-version: 20
-          registry-url: https://registry.npmjs.org/
+      # https://cashapp.github.io/hermit/usage/ci/
+      - name: Init Hermit
+        uses: cashapp/activate-hermit@v1
 
       - name: Install dependencies
         run: pnpm install
diff --git a/.github/workflows/integrity-check.yml b/.github/workflows/integrity-check.yml
index 5f846fd6..2f6e584f 100644
--- a/.github/workflows/integrity-check.yml
+++ b/.github/workflows/integrity-check.yml
@@ -22,15 +22,9 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
 
-      - name: install pnpm
-        uses: pnpm/action-setup@v2
-        with:
-          version: 8
-
-      - name: Set up Node.js
-        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
-        with:
-          node-version: 20
+      # https://cashapp.github.io/hermit/usage/ci/
+      - name: Init Hermit
+        uses: cashapp/activate-hermit@v1
 
       - name: Report known vulnerabilities
         run: pnpm audit
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 61578744..9c26fb6e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,16 +31,9 @@ jobs:
         with:
           submodules: "true"
 
-      - name: install pnpm
-        uses: pnpm/action-setup@v2
-        with:
-          version: 8
-
-      - name: Set up Node.js
-        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
-        with:
-          node-version: 20
-          registry-url: https://registry.npmjs.org/
+      # https://cashapp.github.io/hermit/usage/ci/
+      - name: Init Hermit
+        uses: cashapp/activate-hermit@v1
 
       - name: Verify NPM token is authenticated with NPMjs.com
         env:
diff --git a/.nvmrc b/.nvmrc
deleted file mode 100644
index a5e8bba2..00000000
--- a/.nvmrc
+++ /dev/null
@@ -1 +0,0 @@
-v20.3.0
diff --git a/bin/.node-21.6.2.pkg b/bin/.node-21.6.2.pkg
new file mode 120000
index 00000000..383f4511
--- /dev/null
+++ b/bin/.node-21.6.2.pkg
@@ -0,0 +1 @@
+hermit
\ No newline at end of file
diff --git a/bin/.pnpm-8.15.3.pkg b/bin/.pnpm-8.15.3.pkg
new file mode 120000
index 00000000..383f4511
--- /dev/null
+++ b/bin/.pnpm-8.15.3.pkg
@@ -0,0 +1 @@
+hermit
\ No newline at end of file
diff --git a/bin/README.hermit.md b/bin/README.hermit.md
new file mode 100644
index 00000000..e889550b
--- /dev/null
+++ b/bin/README.hermit.md
@@ -0,0 +1,7 @@
+# Hermit environment
+
+This is a [Hermit](https://github.com/cashapp/hermit) bin directory.
+
+The symlinks in this directory are managed by Hermit and will automatically
+download and install Hermit itself as well as packages. These packages are
+local to this environment.
diff --git a/bin/activate-hermit b/bin/activate-hermit
new file mode 100755
index 00000000..fe28214d
--- /dev/null
+++ b/bin/activate-hermit
@@ -0,0 +1,21 @@
+#!/bin/bash
+# This file must be used with "source bin/activate-hermit" from bash or zsh.
+# You cannot run it directly
+#
+# THIS FILE IS GENERATED; DO NOT MODIFY
+
+if [ "${BASH_SOURCE-}" = "$0" ]; then
+  echo "You must source this script: \$ source $0" >&2
+  exit 33
+fi
+
+BIN_DIR="$(dirname "${BASH_SOURCE[0]:-${(%):-%x}}")"
+if "${BIN_DIR}/hermit" noop > /dev/null; then
+  eval "$("${BIN_DIR}/hermit" activate "${BIN_DIR}/..")"
+
+  if [ -n "${BASH-}" ] || [ -n "${ZSH_VERSION-}" ]; then
+      hash -r 2>/dev/null
+    fi
+
+    echo "Hermit environment $("${HERMIT_ENV}"/bin/hermit env HERMIT_ENV) activated"
+fi
diff --git a/bin/corepack b/bin/corepack
new file mode 120000
index 00000000..d5266e4a
--- /dev/null
+++ b/bin/corepack
@@ -0,0 +1 @@
+.node-21.6.2.pkg
\ No newline at end of file
diff --git a/bin/hermit b/bin/hermit
new file mode 100755
index 00000000..6dbd60cc
--- /dev/null
+++ b/bin/hermit
@@ -0,0 +1,43 @@
+#!/bin/bash
+#
+# THIS FILE IS GENERATED; DO NOT MODIFY
+
+set -eo pipefail
+
+export HERMIT_USER_HOME=~
+
+if [ -z "${HERMIT_STATE_DIR}" ]; then
+  case "$(uname -s)" in
+  Darwin)
+    export HERMIT_STATE_DIR="${HERMIT_USER_HOME}/Library/Caches/hermit"
+    ;;
+  Linux)
+    export HERMIT_STATE_DIR="${XDG_CACHE_HOME:-${HERMIT_USER_HOME}/.cache}/hermit"
+    ;;
+  esac
+fi
+
+export HERMIT_DIST_URL="${HERMIT_DIST_URL:-https://d1abdrezunyhdp.cloudfront.net/square}"
+HERMIT_CHANNEL="$(basename "${HERMIT_DIST_URL}")"
+export HERMIT_CHANNEL
+export HERMIT_EXE=${HERMIT_EXE:-${HERMIT_STATE_DIR}/pkg/hermit@${HERMIT_CHANNEL}/hermit}
+
+if [ ! -x "${HERMIT_EXE}" ]; then
+  echo "Bootstrapping ${HERMIT_EXE} from ${HERMIT_DIST_URL}" 1>&2
+  INSTALL_SCRIPT="$(mktemp)"
+  # This value must match that of the install script
+  INSTALL_SCRIPT_SHA256="d9774f75517f9a6d9e371daae9991cdb9fbbc390101b47c3fb2f6876d9094bab"
+  if [ "${INSTALL_SCRIPT_SHA256}" = "BYPASS" ]; then
+    curl -fsSL "${HERMIT_DIST_URL}/install.sh" -o "${INSTALL_SCRIPT}"
+  else
+    # Install script is versioned by its sha256sum value
+    curl -fsSL "${HERMIT_DIST_URL}/install-${INSTALL_SCRIPT_SHA256}.sh" -o "${INSTALL_SCRIPT}"
+    # Verify install script's sha256sum
+    openssl dgst -sha256 "${INSTALL_SCRIPT}" | \
+      awk -v EXPECTED="$INSTALL_SCRIPT_SHA256" \
+      '$2!=EXPECTED {print "Install script sha256 " $2 " does not match " EXPECTED; exit 1}'
+  fi
+  /bin/bash "${INSTALL_SCRIPT}" 1>&2
+fi
+
+exec "${HERMIT_EXE}" --level=fatal exec "$0" -- "$@"
diff --git a/bin/hermit.hcl b/bin/hermit.hcl
new file mode 100644
index 00000000..e69de29b
diff --git a/bin/node b/bin/node
new file mode 120000
index 00000000..d5266e4a
--- /dev/null
+++ b/bin/node
@@ -0,0 +1 @@
+.node-21.6.2.pkg
\ No newline at end of file
diff --git a/bin/npm b/bin/npm
new file mode 120000
index 00000000..d5266e4a
--- /dev/null
+++ b/bin/npm
@@ -0,0 +1 @@
+.node-21.6.2.pkg
\ No newline at end of file
diff --git a/bin/npx b/bin/npx
new file mode 120000
index 00000000..d5266e4a
--- /dev/null
+++ b/bin/npx
@@ -0,0 +1 @@
+.node-21.6.2.pkg
\ No newline at end of file
diff --git a/bin/pnpm b/bin/pnpm
new file mode 120000
index 00000000..18db3cdf
--- /dev/null
+++ b/bin/pnpm
@@ -0,0 +1 @@
+.pnpm-8.15.3.pkg
\ No newline at end of file