diff --git a/scripts/start-web.sh b/scripts/start-web.sh
index 0c09a08..96d848e 100644
--- a/scripts/start-web.sh
+++ b/scripts/start-web.sh
@@ -17,19 +17,35 @@ echo "[start-web] NEXT_PUBLIC_CONVEX_URL=${NEXT_PUBLIC_CONVEX_URL:-}"
 
 # Ensure system deps for native modules (best-effort, idempotent)
 if command -v apt-get >/dev/null 2>&1; then
+  # Ensure curl/gnupg for NodeSource setup
+  if ! command -v curl >/dev/null 2>&1; then
+    apt-get update -y || true
+    apt-get install -y --no-install-recommends curl ca-certificates gnupg || true
+  fi
+  install_node() {
+    local current_node_major=""
+    if command -v node >/dev/null 2>&1; then
+      current_node_major=$(node -v | sed -E 's/^v([0-9]+).*/\1/')
+      if [ -n "$current_node_major" ] && [ "$current_node_major" -ge 20 ]; then
+        return 0
+      fi
+    fi
+
+    echo "[start-web] installing Node.js 22.x via NodeSource"
+    curl -fsSL https://deb.nodesource.com/setup_22.x | bash - || true
+    apt-get update -y || true
+    apt-get install -y --no-install-recommends nodejs || true
+  }
+
   if ! command -v openssl >/dev/null 2>&1; then
     echo "[start-web] openssl not found; installing via apt-get (requires root)"
     apt-get update -y || true
-    apt-get install -y openssl || true
+    apt-get install -y --no-install-recommends openssl ca-certificates || true
   fi
   if ! command -v node >/dev/null 2>&1 && [ -x /usr/bin/nodejs ]; then
     ln -sf /usr/bin/nodejs /usr/bin/node || true
   fi
-  if ! command -v node >/dev/null 2>&1; then
-    echo "[start-web] node not found; installing via apt-get (requires root)"
-    apt-get update -y || true
-    apt-get install -y nodejs npm || true
-  fi
+  install_node
 else
   echo "[start-web] apt-get unavailable; skipping system deps install" >&2
 fi
@@ -38,11 +54,11 @@ fi
 mkdir -p node_modules/.bun >/dev/null 2>&1 || true
 
 # Prisma generate (idempotent) and apply DB migrations
-echo "[start-web] prisma generate"
-bun run prisma:generate
+echo "[start-web] prisma generate (bun runtime)"
+bunx --bun prisma generate
 
-echo "[start-web] prisma migrate deploy"
-bunx prisma migrate deploy
+echo "[start-web] prisma migrate deploy (bun runtime)"
+bunx --bun prisma migrate deploy
 
 # Seed Better Auth users safely (ensure-only by default)
 if [ "${SKIP_AUTH_SEED:-false}" != "true" ]; then
@@ -55,7 +71,12 @@ fi
 echo "[start-web] launching Next.js"
 PORT=${PORT:-3000}
 if command -v node >/dev/null 2>&1; then
-  exec node node_modules/next/dist/bin/next start --port "$PORT"
+  NODE_MAJOR=$(node -v | sed -E 's/^v([0-9]+).*/\1/')
+  if [ -n "$NODE_MAJOR" ] && [ "$NODE_MAJOR" -ge 20 ]; then
+    exec node node_modules/next/dist/bin/next start --port "$PORT"
+  else
+    echo "[start-web] node version ($NODE_MAJOR) < 20; using bun to start Next.js"
+  fi
 fi
-# Fallback to bun if node is unavailable
+# Fallback to bun if node is unavailable or too old
 exec bun run start -- --port "$PORT"