diff --git a/scripts/check-node-toolchain.mjs b/scripts/check-node-toolchain.mjs
index d6df964b..18767ebe 100644
--- a/scripts/check-node-toolchain.mjs
+++ b/scripts/check-node-toolchain.mjs
@@ -45,11 +45,28 @@ for (const image of nodeImages) {
 	);
 }
 
+const cmpVersion = (a, b) => {
+	const pa = a.split(".").map((part) => Number.parseInt(part, 10));
+	const pb = b.split(".").map((part) => Number.parseInt(part, 10));
+	for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+		const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+		if (diff !== 0) return diff;
+	}
+	return 0;
+};
+
+// `.nvmrc` is the recommended version for reproducible local development and
+// the exact Docker base image (both asserted above), but the *runtime* we run
+// on may be any version the package.json engines range accepts. Requiring an
+// exact patch match here would fail on every Node.js patch release, even when
+// the version is explicitly supported.
 if (!process.argv.includes("--static")) {
-	assert.equal(
-		process.versions.node,
-		pinnedVersion,
-		"the active Node.js runtime must match .nvmrc",
+	const active = process.versions.node;
+	const upperBound = `${major + 1}.0.0`;
+	assert.ok(
+		cmpVersion(active, pinnedVersion) >= 0 &&
+			cmpVersion(active, upperBound) < 0,
+		`the active Node.js runtime (${active}) must satisfy package.json engines.node (${packageJson.engines.node}); .nvmrc pins ${pinnedVersion} as the recommended version`,
 	);
 }