diff --git a/.github/workflows/alpha-npm.yml b/.github/workflows/alpha-npm.yml
index cca9f3aaf..4ed312605 100644
--- a/.github/workflows/alpha-npm.yml
+++ b/.github/workflows/alpha-npm.yml
@@ -27,16 +27,11 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
 
-      - uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d #v3.0.0
+      # https://cashapp.github.io/hermit/usage/ci/
+      - name: Init Hermit
+        uses: cashapp/activate-hermit@v1
         with:
-          version: 8
-
-      - name: Set up Node.js
-        uses: actions/setup-node@5ef044f9d09786428e6e895be6be17937becee3a #v4.0.0
-        with:
-          node-version: 18
-          registry-url: https://registry.npmjs.org/
-          cache: 'pnpm'
+          cache: "true"
 
       # Note - this is not required but it gives a clean failure prior to attempting a release if
       # the GH workflow runner is not authenticated with NPMjs.com
diff --git a/.github/workflows/docs-ci.yml b/.github/workflows/docs-ci.yml
index a48e97840..6d2d308c8 100644
--- a/.github/workflows/docs-ci.yml
+++ b/.github/workflows/docs-ci.yml
@@ -18,16 +18,11 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
 
-      - uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d #v3.0.0
+      # https://cashapp.github.io/hermit/usage/ci/
+      - name: Init Hermit
+        uses: cashapp/activate-hermit@v1
         with:
-          version: 8
-
-      - name: Set up Node.js
-        uses: actions/setup-node@5ef044f9d09786428e6e895be6be17937becee3a #v4.0.0
-        with:
-          node-version: 18
-          registry-url: https://registry.npmjs.org/
-          cache: 'pnpm'
+          cache: "true"
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
diff --git a/.github/workflows/docs-publish.yml b/.github/workflows/docs-publish.yml
index 5415f948c..2fefdb47e 100644
--- a/.github/workflows/docs-publish.yml
+++ b/.github/workflows/docs-publish.yml
@@ -28,20 +28,14 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
 
-      - uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d #v3.0.0
+      # https://cashapp.github.io/hermit/usage/ci/
+      - name: Init Hermit
+        uses: cashapp/activate-hermit@v1
         with:
-          version: 8
-
-      - name: Set up Node.js
-        uses: actions/setup-node@5ef044f9d09786428e6e895be6be17937becee3a #v4.0.0
-        with:
-          node-version: 18
-          registry-url: https://registry.npmjs.org/
-          cache: 'pnpm'
+          cache: "true"
 
       - name: Install dependencies
-        run: |
-          pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
 
       - name: Build all workspace packages
         run: pnpm --recursive --stream build
diff --git a/.github/workflows/release-npm.yml b/.github/workflows/release-npm.yml
index 6be7f4934..038d583c3 100644
--- a/.github/workflows/release-npm.yml
+++ b/.github/workflows/release-npm.yml
@@ -39,17 +39,12 @@ jobs:
     steps:
       - name: Checkout source
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
-
-      - uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d #v3.0.0
-        with:
-          version: 8
-
-      - name: Set up Node.js
-        uses: actions/setup-node@5ef044f9d09786428e6e895be6be17937becee3a #v4.0.0
+      
+      # https://cashapp.github.io/hermit/usage/ci/
+      - name: Init Hermit
+        uses: cashapp/activate-hermit@v1
         with:
-          node-version: 18
-          registry-url: https://registry.npmjs.org/
-          cache: 'pnpm'
+          cache: "true"
 
       - name: Install semver utility
         run: pnpm install -g semver@7.5.1
diff --git a/.github/workflows/tests-ci.yml b/.github/workflows/tests-ci.yml
index e3bbb163d..640aa8bc6 100644
--- a/.github/workflows/tests-ci.yml
+++ b/.github/workflows/tests-ci.yml
@@ -125,17 +125,12 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
         with:
           submodules: true
-      
-      - uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d #v3.0.0
-        with:
-          version: 8
 
-      - name: Set up Node.js
-        uses: actions/setup-node@5ef044f9d09786428e6e895be6be17937becee3a #v4.0.0
+      # https://cashapp.github.io/hermit/usage/ci/
+      - name: Init Hermit
+        uses: cashapp/activate-hermit@v1
         with:
-          node-version: 18
-          registry-url: https://registry.npmjs.org/
-          cache: 'pnpm'
+          cache: "true"
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index e12a13d02..37eda38c5 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -50,26 +50,19 @@ Build and Test cycles are run on every commit to every branch using [GitHub Acti
 
 ## Development Prerequisites
 
-| Requirement | Tested Version | Installation Instructions                                                                      |
-| ----------- | -------------- | ---------------------------------------------------------------------------------------------- |
-| Node.js     | 18.16.0        | [Introduction to Node.js](https://nodejs.dev/en/learn/)                                        |
-| PNPM        | 8.15.3         | [PNPM Package Manager](https://pnpm.io/installation)                                           |
+### Hermit
+This project uses hermit to manage tooling like node. See [this page](https://cashapp.github.io/hermit/usage/get-started/) to set up Hermit on your machine - make sure to download the open source build and activate it for the project.
 
-### TypeScript
-
-This project is written in TypeScript, a strongly typed programming language that builds on JavaScript.
+Currently, we have these packages installed via Hermit (can also view by checking out `hermit status`):
 
-You may verify your `node` and `pnpm` installation via the terminal:
+| Requirement | Tested Version | 
+| ----------- | -------------- | 
+| Node.js     | 20.9.0        | 
+| PNPM        | 8.15.4         |
 
-```
-$ node --version
-v18.16.0
-$ pnpm --version
-8.15.3
-```
+### TypeScript
 
-If you do not have Node.js installed, we recommend following the
-[Introduction to Node.js](https://nodejs.dev/en/learn/) guide.
+This project is written in TypeScript, a strongly typed programming language that builds on JavaScript.
 
 ## Contribution
 
diff --git a/README.md b/README.md
index 01c5359ab..d336daf1d 100644
--- a/README.md
+++ b/README.md
@@ -65,6 +65,13 @@ We recommend this config which will only checkout the files relevant to web5-js
 git -C web5-spec sparse-checkout set test-vectors
 ```
 
+### Hermit
+This project uses hermit to manage tooling like node. See [this page](https://cashapp.github.io/hermit/usage/get-started/) to set up Hermit on your machine - make sure to download the open source build and activate it for the project.
+
+Currently, we have these packages installed via Hermit (can also view by checking out `hermit status`):
+- node 
+- pnpm
+
 ## Installation
 
 _NPM_
diff --git a/bin/.node-20.9.0.pkg b/bin/.node-20.9.0.pkg
new file mode 120000
index 000000000..383f4511d
--- /dev/null
+++ b/bin/.node-20.9.0.pkg
@@ -0,0 +1 @@
+hermit
\ No newline at end of file
diff --git a/bin/.pnpm-8.15.4.pkg b/bin/.pnpm-8.15.4.pkg
new file mode 120000
index 000000000..383f4511d
--- /dev/null
+++ b/bin/.pnpm-8.15.4.pkg
@@ -0,0 +1 @@
+hermit
\ No newline at end of file
diff --git a/bin/README.hermit.md b/bin/README.hermit.md
new file mode 100644
index 000000000..e889550ba
--- /dev/null
+++ b/bin/README.hermit.md
@@ -0,0 +1,7 @@
+# Hermit environment
+
+This is a [Hermit](https://github.com/cashapp/hermit) bin directory.
+
+The symlinks in this directory are managed by Hermit and will automatically
+download and install Hermit itself as well as packages. These packages are
+local to this environment.
diff --git a/bin/activate-hermit b/bin/activate-hermit
new file mode 100755
index 000000000..fe28214d3
--- /dev/null
+++ b/bin/activate-hermit
@@ -0,0 +1,21 @@
+#!/bin/bash
+# This file must be used with "source bin/activate-hermit" from bash or zsh.
+# You cannot run it directly
+#
+# THIS FILE IS GENERATED; DO NOT MODIFY
+
+if [ "${BASH_SOURCE-}" = "$0" ]; then
+  echo "You must source this script: \$ source $0" >&2
+  exit 33
+fi
+
+BIN_DIR="$(dirname "${BASH_SOURCE[0]:-${(%):-%x}}")"
+if "${BIN_DIR}/hermit" noop > /dev/null; then
+  eval "$("${BIN_DIR}/hermit" activate "${BIN_DIR}/..")"
+
+  if [ -n "${BASH-}" ] || [ -n "${ZSH_VERSION-}" ]; then
+      hash -r 2>/dev/null
+    fi
+
+    echo "Hermit environment $("${HERMIT_ENV}"/bin/hermit env HERMIT_ENV) activated"
+fi
diff --git a/bin/corepack b/bin/corepack
new file mode 120000
index 000000000..a18aecd8e
--- /dev/null
+++ b/bin/corepack
@@ -0,0 +1 @@
+.node-20.9.0.pkg
\ No newline at end of file
diff --git a/bin/hermit b/bin/hermit
new file mode 100755
index 000000000..7fef76924
--- /dev/null
+++ b/bin/hermit
@@ -0,0 +1,43 @@
+#!/bin/bash
+#
+# THIS FILE IS GENERATED; DO NOT MODIFY
+
+set -eo pipefail
+
+export HERMIT_USER_HOME=~
+
+if [ -z "${HERMIT_STATE_DIR}" ]; then
+  case "$(uname -s)" in
+  Darwin)
+    export HERMIT_STATE_DIR="${HERMIT_USER_HOME}/Library/Caches/hermit"
+    ;;
+  Linux)
+    export HERMIT_STATE_DIR="${XDG_CACHE_HOME:-${HERMIT_USER_HOME}/.cache}/hermit"
+    ;;
+  esac
+fi
+
+export HERMIT_DIST_URL="${HERMIT_DIST_URL:-https://github.com/cashapp/hermit/releases/download/stable}"
+HERMIT_CHANNEL="$(basename "${HERMIT_DIST_URL}")"
+export HERMIT_CHANNEL
+export HERMIT_EXE=${HERMIT_EXE:-${HERMIT_STATE_DIR}/pkg/hermit@${HERMIT_CHANNEL}/hermit}
+
+if [ ! -x "${HERMIT_EXE}" ]; then
+  echo "Bootstrapping ${HERMIT_EXE} from ${HERMIT_DIST_URL}" 1>&2
+  INSTALL_SCRIPT="$(mktemp)"
+  # This value must match that of the install script
+  INSTALL_SCRIPT_SHA256="180e997dd837f839a3072a5e2f558619b6d12555cd5452d3ab19d87720704e38"
+  if [ "${INSTALL_SCRIPT_SHA256}" = "BYPASS" ]; then
+    curl -fsSL "${HERMIT_DIST_URL}/install.sh" -o "${INSTALL_SCRIPT}"
+  else
+    # Install script is versioned by its sha256sum value
+    curl -fsSL "${HERMIT_DIST_URL}/install-${INSTALL_SCRIPT_SHA256}.sh" -o "${INSTALL_SCRIPT}"
+    # Verify install script's sha256sum
+    openssl dgst -sha256 "${INSTALL_SCRIPT}" | \
+      awk -v EXPECTED="$INSTALL_SCRIPT_SHA256" \
+      '$2!=EXPECTED {print "Install script sha256 " $2 " does not match " EXPECTED; exit 1}'
+  fi
+  /bin/bash "${INSTALL_SCRIPT}" 1>&2
+fi
+
+exec "${HERMIT_EXE}" --level=fatal exec "$0" -- "$@"
diff --git a/bin/hermit.hcl b/bin/hermit.hcl
new file mode 100644
index 000000000..e69de29bb
diff --git a/bin/node b/bin/node
new file mode 120000
index 000000000..a18aecd8e
--- /dev/null
+++ b/bin/node
@@ -0,0 +1 @@
+.node-20.9.0.pkg
\ No newline at end of file
diff --git a/bin/npm b/bin/npm
new file mode 120000
index 000000000..a18aecd8e
--- /dev/null
+++ b/bin/npm
@@ -0,0 +1 @@
+.node-20.9.0.pkg
\ No newline at end of file
diff --git a/bin/npx b/bin/npx
new file mode 120000
index 000000000..a18aecd8e
--- /dev/null
+++ b/bin/npx
@@ -0,0 +1 @@
+.node-20.9.0.pkg
\ No newline at end of file
diff --git a/bin/pnpm b/bin/pnpm
new file mode 120000
index 000000000..ccd74cafc
--- /dev/null
+++ b/bin/pnpm
@@ -0,0 +1 @@
+.pnpm-8.15.4.pkg
\ No newline at end of file
diff --git a/packages/agent/package.json b/packages/agent/package.json
index e7d8f1952..77f9f6074 100644
--- a/packages/agent/package.json
+++ b/packages/agent/package.json
@@ -65,7 +65,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.9.0"
   },
   "dependencies": {
     "@noble/hashes": "1.3.3",
diff --git a/packages/api/package.json b/packages/api/package.json
index c78d15935..45e653cd0 100644
--- a/packages/api/package.json
+++ b/packages/api/package.json
@@ -73,7 +73,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.9.0"
   },
   "dependencies": {
     "@tbd54566975/dwn-sdk-js": "0.2.10",
diff --git a/packages/common/package.json b/packages/common/package.json
index eedc65be9..55f117261 100644
--- a/packages/common/package.json
+++ b/packages/common/package.json
@@ -65,7 +65,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.9.0"
   },
   "dependencies": {
     "@isaacs/ttlcache": "1.4.1",
diff --git a/packages/credentials/package.json b/packages/credentials/package.json
index 5ddfc0d6c..355e01dd4 100644
--- a/packages/credentials/package.json
+++ b/packages/credentials/package.json
@@ -71,7 +71,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.9.0"
   },
   "dependencies": {
     "@sphereon/pex": "2.1.0",
@@ -104,4 +104,4 @@
     "sinon": "16.1.3",
     "typescript": "5.1.6"
   }
-}
+}
\ No newline at end of file
diff --git a/packages/crypto-aws-kms/package.json b/packages/crypto-aws-kms/package.json
index bf7931c2d..c15dbac16 100644
--- a/packages/crypto-aws-kms/package.json
+++ b/packages/crypto-aws-kms/package.json
@@ -66,7 +66,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.9.0"
   },
   "dependencies": {
     "@aws-sdk/client-kms": "3.478.0",
@@ -98,4 +98,4 @@
     "source-map-loader": "4.0.2",
     "typescript": "5.1.6"
   }
-}
+}
\ No newline at end of file
diff --git a/packages/crypto/package.json b/packages/crypto/package.json
index 756a7b541..87a82e207 100644
--- a/packages/crypto/package.json
+++ b/packages/crypto/package.json
@@ -71,7 +71,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.9.0"
   },
   "dependencies": {
     "@noble/ciphers": "0.4.1",
@@ -105,4 +105,4 @@
     "source-map-loader": "4.0.2",
     "typescript": "5.1.6"
   }
-}
+}
\ No newline at end of file
diff --git a/packages/dids/package.json b/packages/dids/package.json
index a6d600e59..9ce610f48 100644
--- a/packages/dids/package.json
+++ b/packages/dids/package.json
@@ -72,7 +72,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.9.0"
   },
   "dependencies": {
     "@decentralized-identity/ion-sdk": "1.0.1",
@@ -113,4 +113,4 @@
     "source-map-loader": "4.0.2",
     "typescript": "5.1.6"
   }
-}
+}
\ No newline at end of file
diff --git a/packages/identity-agent/package.json b/packages/identity-agent/package.json
index 4d631032b..7235f22a3 100644
--- a/packages/identity-agent/package.json
+++ b/packages/identity-agent/package.json
@@ -65,7 +65,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.9.0"
   },
   "dependencies": {
     "@web5/agent": "0.2.6",
@@ -100,4 +100,4 @@
     "sinon": "16.1.3",
     "typescript": "5.1.6"
   }
-}
+}
\ No newline at end of file
diff --git a/packages/proxy-agent/package.json b/packages/proxy-agent/package.json
index ddb82a3e0..4a4253079 100644
--- a/packages/proxy-agent/package.json
+++ b/packages/proxy-agent/package.json
@@ -65,7 +65,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.9.0"
   },
   "dependencies": {
     "@web5/agent": "0.2.6",
@@ -98,4 +98,4 @@
     "rimraf": "4.4.0",
     "typescript": "5.1.6"
   }
-}
+}
\ No newline at end of file
diff --git a/packages/user-agent/package.json b/packages/user-agent/package.json
index 708e30336..e8937aaca 100644
--- a/packages/user-agent/package.json
+++ b/packages/user-agent/package.json
@@ -65,7 +65,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.9.0"
   },
   "dependencies": {
     "@web5/agent": "0.2.6",
@@ -98,4 +98,4 @@
     "rimraf": "4.4.0",
     "typescript": "5.1.6"
   }
-}
+}
\ No newline at end of file