@@ -25,16 +25,30 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node_major: ["18", "20", "22", "24", "26"]
+        # Host Node must match the Lambda runtime so yarn installs the
+        # matching dd-trace line (v5 on 18/20, v6 on 22+) with working
+        # native prebuilds. Packing v6 on Node 18 (--ignore-engines) is
+        # what local Node 22+ never hits.
+        include:
+          - node_major: "18"
+            node_version: "18.12"
+          - node_major: "20"
+            node_version: "20.19"
+          - node_major: "22"
+            node_version: "22.11"
+          - node_major: "24"
+            node_version: "24.11"
+          - node_major: "26"
+            node_version: "26.1"
 
     steps:
       - name: Checkout
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
-      - name: Set up Node 18.12
+      - name: Set up Node ${{ matrix.node_version }}
         uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
-          node-version: 18.12
+          node-version: ${{ matrix.node_version }}
 
       - name: Run local container integration tests (nodejs${{ matrix.node_major }}.x)
         run: PLATFORM=linux/amd64 RUNTIME_PARAM=${{ matrix.node_major }} ./integration_tests_local/run.sh
 
@@ -47,9 +47,10 @@ PLATFORM=linux/amd64 ./integration_tests_local/run.sh
 On a tree that pins dd-trace v6 (which older runtimes cannot install), the
 pack step installs through `scripts/install_deps.sh` with
 `TARGET_NODE_MAJOR=$RUNTIME_PARAM` and the container fixtures get a matching
-`DD_TRACE_VERSION` build-arg. Run per-runtime there, like CI does: a full
-sweep packs only once, so its layer fixture would carry the first leg's
-tracer line into every other leg.
+`DD_TRACE_VERSION` build-arg. Packing the v6 line needs host Node 22+ (CI
+sets `setup-node` to the matrix runtime for that reason). Run per-runtime
+there, like CI does: a full sweep packs only once, so its layer fixture
+would carry the first leg's tracer line into every other leg.
 
 The case names are:
 
 
@@ -385,15 +385,11 @@ if [ -z "$SKIP_PACK" ]; then
     echo "Packing local datadog-lambda-js for container tests"
     cd "$repo_dir"
     if [ -f "$repo_dir/scripts/install_deps.sh" ]; then
-        # dd-trace v6 world: the repo pins a tracer whose engines may reject
-        # the host node (e.g. v6 requires node >=22 while CI hosts node 18).
         # install_deps.sh installs the tracer line matching the target
-        # runtime, rewriting package.json/yarn.lock and restoring them via a
-        # trap on exit, so the worktree is left untouched.
-        # NOTE: in the v6 world a full local sweep packs once with
-        # TARGET_NODE_MAJOR=$RUNTIME_PARAM (default 22); run per-runtime like
-        # CI does (RUNTIME_PARAM=18 ./integration_tests_local/run.sh) so the
-        # layer fixture's pinned dd-trace matches each leg.
+        # runtime (v5 on 18/20, v6 on 22+). v6 install requires host Node 22+.
+        # A full sweep packs once; run per-runtime like CI
+        # (RUNTIME_PARAM=18 ./integration_tests_local/run.sh) so the layer
+        # fixture's pinned dd-trace matches each leg.
         TARGET_NODE_MAJOR=${RUNTIME_PARAM:-22} "$repo_dir/scripts/install_deps.sh"
     else
         yarn install --frozen-lockfile
 
@@ -12,8 +12,9 @@
 # USAGE: [TARGET_NODE_MAJOR=22] ./scripts/install_deps.sh [extra yarn args...]
 #
 # TARGET_NODE_MAJOR defaults to the Node major running this script. Set it
-# explicitly when the host Node version differs from the runtime being built
-# for, e.g. the GitLab CI image runs Node 18 but builds for every runtime.
+# when the host differs from the runtime being built for (e.g. Node 22
+# packing a Node 18 fixture, which pins v5). Installing v6 still requires
+# a host of Node 22+ so native prebuilds resolve.
 
 set -e
 
@@ -29,9 +30,19 @@ if [ -z "$TARGET_NODE_MAJOR" ]; then
 fi
 
 dd_trace_override=$(dd_trace_version_for_node_major "$TARGET_NODE_MAJOR")
+host_major=$(node -p "process.versions.node.split('.')[0]")
 
-# --ignore-engines is needed on both paths: dd-trace v6 refuses to install on
-# hosts older than Node 22 even when it is only being built for a newer runtime.
+# v6's optional native addons (pprof, appsec, oxc-parser) ship prebuilds for
+# Node 22+ only. --ignore-engines would let yarn extract the tarball on
+# Node 18, then node-gyp-build fails and the tree is unusable. Pin v5 instead.
+if [ -z "$dd_trace_override" ] && [ "$host_major" -lt "$DD_TRACE_V6_MIN_NODE_MAJOR" ]; then
+    echo "dd-trace v6 cannot be installed on Node ${host_major} (engines.node >= ${DD_TRACE_V6_MIN_NODE_MAJOR})." >&2
+    echo "Use Node ${DD_TRACE_V6_MIN_NODE_MAJOR}+, or set TARGET_NODE_MAJOR to 18 or 20 to pin v5." >&2
+    exit 1
+fi
+
+# Nested packages still declare engines that reject some hosts; yarn 1
+# otherwise fails the whole install on an engines mismatch.
 yarn_args=("--ignore-engines")
 
 if [ -n "$dd_trace_override" ]; then