diff --git a/.github/workflows/bot.yml b/.github/workflows/bot.yml
index 29489f008140..a9c97db21b6f 100644
--- a/.github/workflows/bot.yml
+++ b/.github/workflows/bot.yml
@@ -76,7 +76,8 @@ jobs:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           retries: 3
           script: |
-            require('./ci/github-script/bot.js')({
+            const { default: bot } = await import('${{ github.workspace }}/ci/github-script/bot.js')
+            await bot({
               github,
               context,
               core,
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index e30e2f819e44..d6cdd5564220 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -76,7 +76,8 @@ jobs:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
             const targetsStable = JSON.parse(process.env.TARGETS_STABLE)
-            require('./trusted/ci/github-script/commits.js')({
+            const { default: commits } = await import('${{ github.workspace }}/trusted/ci/github-script/commits.js')
+            await commits({
               github,
               context,
               core,
@@ -121,7 +122,8 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
-            require('./trusted/ci/github-script/manual-file-edits.js')({
+            const { default: checkManualFileEdits } = await import('${{ github.workspace }}/trusted/ci/github-script/manual-file-edits.js')
+            await checkManualFileEdits({
               github,
               context,
               core,
diff --git a/.github/workflows/comment.yml b/.github/workflows/comment.yml
index 98006f23b4d0..ab56a3608d0f 100644
--- a/.github/workflows/comment.yml
+++ b/.github/workflows/comment.yml
@@ -43,7 +43,7 @@ jobs:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           retries: 3
           script: |
-            const { handleMergeComment } = require('./ci/github-script/merge.js')
+            const { handleMergeComment } = await import('${{ github.workspace }}/ci/github-script/merge.js')
             const { body, node_id } = context.payload.comment
 
             await handleMergeComment({
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 567bf3a47447..61d8b60d2bab 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -375,7 +375,8 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
-            require('./nixpkgs/trusted/ci/github-script/check-target-branch.ts')({
+            const { checkTargetBranch } = await import('${{ github.workspace }}/nixpkgs/trusted/ci/github-script/check-target-branch.ts')
+            await checkTargetBranch({
               github,
               context,
               core,
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index d6d4627ada81..b90840319c5b 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -142,9 +142,9 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
-            const checkCommitMessages = require('./trusted/ci/github-script/lint-commits.js')
+            const { default: checkCommitMessages } = await import('${{ github.workspace }}/trusted/ci/github-script/lint-commits.js')
 
-            checkCommitMessages({
+            await checkCommitMessages({
               github,
               context,
               core,
diff --git a/.github/workflows/merge-group.yml b/.github/workflows/merge-group.yml
index e1dfa01dbda3..1156c2a616eb 100644
--- a/.github/workflows/merge-group.yml
+++ b/.github/workflows/merge-group.yml
@@ -29,7 +29,7 @@ jobs:
         with:
           persist-credentials: false
           sparse-checkout: |
-            ci/github-script/supportedSystems.js
+            ci/github-script
 
       - id: prepare
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -38,8 +38,8 @@ jobs:
           TARGET_SHA: ${{ inputs.targetSha }}
         with:
           script: |
-            const { classify } = require('./ci/github-script/supportedBranches.js')
-            const supportedSystems = require('./ci/github-script/supportedSystems.js')
+            const { classify } = await import('${{ github.workspace }}/ci/github-script/supportedBranches.js')
+            const { default: supportedSystems } = await import('${{ github.workspace }}/ci/github-script/supportedSystems.js')
 
             const baseBranch = (
               context.payload.merge_group?.base_ref ??
diff --git a/.github/workflows/pull-request-target.yml b/.github/workflows/pull-request-target.yml
index d4fda08d2e01..48f74b6dd930 100644
--- a/.github/workflows/pull-request-target.yml
+++ b/.github/workflows/pull-request-target.yml
@@ -64,7 +64,8 @@ jobs:
           #   https://github.com/octokit/plugin-retry.js/blob/9a2443746c350b3beedec35cf26e197ea318a261/src/index.ts#L14
           retry-exempt-status-codes: 400,401,403,404
           script: |
-            require('./ci/github-script/prepare.js')({
+            const { default: prepare } = await import('${{ github.workspace }}/ci/github-script/prepare.js')
+            await prepare({
               github,
               context,
               core,
diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml
index 3d412b7fd978..9e5d32e81315 100644
--- a/.github/workflows/review.yml
+++ b/.github/workflows/review.yml
@@ -40,7 +40,7 @@ jobs:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           retries: 3
           script: |
-            const { handleMergeComment } = require('./ci/github-script/merge.js')
+            const { handleMergeComment } = await import('${{ github.workspace }}/ci/github-script/merge.js')
 
             // PRs from forks don't have any PRs associated by default.
             // Thus, we request the PR number with an API call *to* the fork's repo.
diff --git a/.github/workflows/teams.yml b/.github/workflows/teams.yml
index 93c6d89e0a5d..1e6ed3175cf4 100644
--- a/.github/workflows/teams.yml
+++ b/.github/workflows/teams.yml
@@ -46,7 +46,8 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token }}
           script: |
-            require('./ci/github-script/get-teams.js')({
+            const { default: getTeams } = await import('${{ github.workspace }}/ci/github-script/get-teams.js')
+            await getTeams({
               github,
               context,
               core,
@@ -78,4 +79,3 @@ jobs:
             This is an automated PR to sync the GitHub teams with access to this repository to the `lib.teams` list.
 
             This PR can be merged without taking any further action.
-
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 90be0ae08ced..d8ea1194f879 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -35,7 +35,8 @@ jobs:
           #   https://github.com/octokit/plugin-retry.js/blob/9a2443746c350b3beedec35cf26e197ea318a261/src/index.ts#L14
           retry-exempt-status-codes: 400,401,403,404
           script: |
-            require('./ci/github-script/prepare.js')({
+            const { default: prepare } = await import('${{ github.workspace }}/ci/github-script/prepare.js')
+            await prepare({
               github,
               context,
               core,
@@ -61,6 +62,8 @@ jobs:
               '.github/workflows/lint.yml',
               '.github/workflows/merge-group.yml',
               '.github/workflows/test.yml',
+              'ci/github-script/package.json',
+              'ci/github-script/package-lock.json',
               'ci/github-script/supportedBranches.js',
               'ci/github-script/supportedSystems.js',
               'ci/pinned.json',
@@ -82,6 +85,8 @@ jobs:
               'ci/github-script/get-pr-commit-details.js',
               'ci/github-script/lint-commits.js',
               'ci/github-script/merge.js',
+              'ci/github-script/package.json',
+              'ci/github-script/package-lock.json',
               'ci/github-script/prepare.js',
               'ci/github-script/reviewers.js',
               'ci/github-script/reviews.js',
diff --git a/ci/github-script/bot.js b/ci/github-script/bot.js
index 0646cd35953d..755b1f71dfdc 100644
--- a/ci/github-script/bot.js
+++ b/ci/github-script/bot.js
@@ -1,13 +1,13 @@
 // @ts-nocheck
-module.exports = async ({ github, context, core, dry }) => {
-  const path = require('node:path')
-  const { DefaultArtifactClient } = await import('@actions/artifact')
-  const { readFile, writeFile } = require('node:fs/promises')
-  const withRateLimit = require('./withRateLimit.js')
-  const { classify } = require('./supportedBranches.js')
-  const { handleMerge } = require('./merge.js')
-  const { handleReviewers } = require('./reviewers.js')
+import { readFile, writeFile } from 'node:fs/promises'
+import path from 'node:path'
+import { DefaultArtifactClient } from '@actions/artifact'
+import { handleMerge } from './merge.js'
+import { handleReviewers } from './reviewers.js'
+import { classify } from './supportedBranches.js'
+import withRateLimit from './withRateLimit.js'
 
+export default async ({ github, context, core, dry }) => {
   const artifactClient = new DefaultArtifactClient()
 
   // Detect if running in a fork (not NixOS/nixpkgs)
diff --git a/ci/github-script/check-target-branch-policy.test.ts b/ci/github-script/check-target-branch-policy.test.ts
index a9feca6aea7a..008b88c97524 100644
--- a/ci/github-script/check-target-branch-policy.test.ts
+++ b/ci/github-script/check-target-branch-policy.test.ts
@@ -1,8 +1,6 @@
-const assert = require('node:assert/strict')
-const test = require('node:test')
-const {
-  evaluateTargetBranchPolicy,
-} = require('./check-target-branch-policy.ts')
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { evaluateTargetBranchPolicy } from './check-target-branch-policy.ts'
 
 type DecisionFacts = {
   base: string
diff --git a/ci/github-script/check-target-branch-policy.ts b/ci/github-script/check-target-branch-policy.ts
index 75870b21b0bf..288fdeecdf4d 100644
--- a/ci/github-script/check-target-branch-policy.ts
+++ b/ci/github-script/check-target-branch-policy.ts
@@ -1,4 +1,4 @@
-const { classify, split } = require('./supportedBranches.js')
+import { classify, split } from './supportedBranches.js'
 
 type TargetBranchPolicyFacts = {
   base: string
@@ -23,7 +23,13 @@ type TargetBranchPolicyResult = {
   }
 }
 
-function getTargetBranchPolicy({ base, head }: { base: string; head: string }) {
+export function getTargetBranchPolicy({
+  base,
+  head,
+}: {
+  base: string
+  head: string
+}) {
   const baseClassification = classify(base)
   const headClassification = classify(head)
   const isPrimaryBase = baseClassification.type.includes('primary')
@@ -42,7 +48,7 @@ function getTargetBranchPolicy({ base, head }: { base: string; head: string }) {
   }
 }
 
-function evaluateTargetBranchPolicy({
+export function evaluateTargetBranchPolicy({
   base,
   head,
   maxRebuildCount,
@@ -105,5 +111,3 @@ function evaluateTargetBranchPolicy({
     shouldSkipDevelopmentMerge ? 'skip-development-merge' : 'dismiss',
   )
 }
-
-module.exports = { evaluateTargetBranchPolicy, getTargetBranchPolicy }
diff --git a/ci/github-script/check-target-branch.ts b/ci/github-script/check-target-branch.ts
index 4d0ff3dda30d..b12c2aa9d68b 100644
--- a/ci/github-script/check-target-branch.ts
+++ b/ci/github-script/check-target-branch.ts
@@ -1,19 +1,18 @@
+import { readFile } from 'node:fs/promises'
 import type * as actionsCore from '@actions/core'
 import type { context as actionsContext } from '@actions/github'
 import type { GitHub } from '@actions/github/lib/utils'
+import {
+  evaluateTargetBranchPolicy,
+  getTargetBranchPolicy,
+} from './check-target-branch-policy.ts'
+import { dismissReviews, postReview } from './reviews.js'
+import { split } from './supportedBranches.js'
 
 // TODO: should this be combined with the branch checks in prepare.js?
 // They do seem quite similar, but this needs to run after eval,
 // and prepare.js obviously doesn't.
 
-const { split } = require('./supportedBranches.js')
-const { readFile } = require('node:fs/promises')
-const { postReview, dismissReviews } = require('./reviews.js')
-const {
-  evaluateTargetBranchPolicy,
-  getTargetBranchPolicy,
-} = require('./check-target-branch-policy.ts')
-
 const reviewKey = 'check-target-branch'
 
 type ChangedPaths = {
@@ -130,7 +129,7 @@ async function postPossibleMassRebuildReview(facts: TargetBranchReviewFacts) {
   })
 }
 
-async function checkTargetBranch({
+export async function checkTargetBranch({
   github,
   context,
   core,
@@ -241,5 +240,3 @@ async function checkTargetBranch({
     reviewKey,
   })
 }
-
-module.exports = checkTargetBranch
diff --git a/ci/github-script/commits.js b/ci/github-script/commits.js
index 5563ceaa7fc6..081496781a0f 100644
--- a/ci/github-script/commits.js
+++ b/ci/github-script/commits.js
@@ -1,9 +1,10 @@
 // @ts-nocheck
-module.exports = async ({ github, context, core, dry, cherryPicks }) => {
-  const { execFileSync } = require('node:child_process')
-  const { classify } = require('./supportedBranches.js')
-  const withRateLimit = require('./withRateLimit.js')
-  const { dismissReviews, postReview } = require('./reviews.js')
+import { execFileSync } from 'node:child_process'
+import { dismissReviews, postReview } from './reviews.js'
+import { classify } from './supportedBranches.js'
+import withRateLimit from './withRateLimit.js'
+
+export default async ({ github, context, core, dry, cherryPicks }) => {
   const reviewKey = 'check-commits'
 
   await withRateLimit({ github, core }, async (stats) => {
diff --git a/ci/github-script/get-pr-commit-details.js b/ci/github-script/get-pr-commit-details.js
index 69e3473da32b..a1355e96af24 100644
--- a/ci/github-script/get-pr-commit-details.js
+++ b/ci/github-script/get-pr-commit-details.js
@@ -1,6 +1,7 @@
-// @ts-nocheck
-const { promisify } = require('node:util')
-const execFile = promisify(require('node:child_process').execFile)
+import { execFile as nodeExecFile } from 'node:child_process'
+import { promisify } from 'node:util'
+
+const execFile = promisify(nodeExecFile)
 
 /**
  * @typedef {{
@@ -41,13 +42,13 @@ async function runGit({ args, repoPath, core, quiet }) {
  *
  * @param {{
  *  core: typeof import('@actions/core'),
- *  pr: Awaited<ReturnType<InstanceType<import('@actions/github/lib/utils').GitHub>["rest"]["pulls"]["get"]>>["data"]
+ *  pr: Awaited<ReturnType<InstanceType<typeof import('@actions/github/lib/utils').GitHub>["rest"]["pulls"]["get"]>>["data"]
  *  repoPath?: string,
  * }} GetCommitMessagesForPRProps
  *
  * @returns {Promise<Commit[]>}
  */
-async function getCommitDetailsForPR({ core, pr, repoPath }) {
+export async function getCommitDetailsForPR({ core, pr, repoPath }) {
   await runGit({
     args: ['fetch', `--depth=1`, 'origin', pr.base.sha],
     repoPath,
@@ -113,5 +114,3 @@ async function getCommitDetailsForPR({ core, pr, repoPath }) {
     }),
   )
 }
-
-module.exports = { getCommitDetailsForPR }
diff --git a/ci/github-script/get-teams.js b/ci/github-script/get-teams.js
index 403250525290..577dd0e81436 100644
--- a/ci/github-script/get-teams.js
+++ b/ci/github-script/get-teams.js
@@ -1,14 +1,14 @@
 // @ts-nocheck
+import { writeFileSync } from 'node:fs'
+import withRateLimit from './withRateLimit.js'
+
 const excludeTeams = [
   /^voters.*$/,
   /^nixpkgs-maintainers$/,
   /^nixpkgs-committers$/,
 ]
 
-module.exports = async ({ github, context, core, outFile }) => {
-  const withRateLimit = require('./withRateLimit.js')
-  const { writeFileSync } = require('node:fs')
-
+export default async ({ github, context, core, outFile }) => {
   const org = context.repo.owner
 
   const result = {}
diff --git a/ci/github-script/lint-commits.js b/ci/github-script/lint-commits.js
index 8380f19c917b..bbeea0990213 100644
--- a/ci/github-script/lint-commits.js
+++ b/ci/github-script/lint-commits.js
@@ -1,5 +1,5 @@
-const { classify } = require('./supportedBranches.js')
-const { getCommitDetailsForPR } = require('./get-pr-commit-details.js')
+import { getCommitDetailsForPR } from './get-pr-commit-details.js'
+import { classify } from './supportedBranches.js'
 
 /** @typedef {import('./get-pr-commit-details.js').Commit} Commit */
 
@@ -11,7 +11,7 @@ const { getCommitDetailsForPR } = require('./get-pr-commit-details.js')
  *  repoPath?: string,
  * }} LintCommitsProps
  */
-async function lintCommits({ github, context, core, repoPath }) {
+export default async function lintCommits({ github, context, core, repoPath }) {
   // This check should only be run when we have the pull_request context.
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
@@ -220,5 +220,3 @@ async function checkCommitMetadata({ commits, core }) {
     core.setFailed('Committers: merging is discouraged.')
   }
 }
-
-module.exports = lintCommits
diff --git a/ci/github-script/manual-file-edits.js b/ci/github-script/manual-file-edits.js
index 34d9bb1aa3e5..bac83d1ce6b2 100644
--- a/ci/github-script/manual-file-edits.js
+++ b/ci/github-script/manual-file-edits.js
@@ -1,5 +1,6 @@
-const { classify } = require('./supportedBranches.js')
-const { getCommitDetailsForPR } = require('./get-pr-commit-details')
+import { getCommitDetailsForPR } from './get-pr-commit-details.js'
+import { dismissReviews, postReview } from './reviews.js'
+import { classify } from './supportedBranches.js'
 
 /**
  * @param {{
@@ -10,8 +11,13 @@ const { getCommitDetailsForPR } = require('./get-pr-commit-details')
  *  dry: boolean,
  * }} CheckManualFileEditsProps
  */
-async function checkManualFileEdits({ github, context, core, repoPath, dry }) {
-  const { dismissReviews, postReview } = require('./reviews.js')
+export default async function checkManualFileEdits({
+  github,
+  context,
+  core,
+  repoPath,
+  dry,
+}) {
   const reviewKey = 'manual-file-edits'
 
   const pull_number = context.payload.pull_request?.number
@@ -90,5 +96,3 @@ async function checkManualFileEdits({ github, context, core, repoPath, dry }) {
     })
   }
 }
-
-module.exports = checkManualFileEdits
diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js
index 6712d54cc2b6..367d70c415f4 100644
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -1,5 +1,5 @@
 // @ts-nocheck
-const { classify } = require('./supportedBranches.js')
+import { classify } from './supportedBranches.js'
 
 function runChecklist({
   committers,
@@ -123,7 +123,7 @@ function hasMergeCommand(body) {
     .match(/^@NixOS\/nixpkgs-merge-bot merge\s*$/im)
 }
 
-async function handleMergeComment({ github, body, node_id, reaction }) {
+export async function handleMergeComment({ github, body, node_id, reaction }) {
   if (!hasMergeCommand(body)) return
 
   await github.graphql(
@@ -138,7 +138,7 @@ async function handleMergeComment({ github, body, node_id, reaction }) {
   )
 }
 
-async function handleMerge({
+export async function handleMerge({
   github,
   context,
   core,
@@ -409,8 +409,3 @@ async function handleMerge({
   // This is used to set the respective label in bot.js.
   return result
 }
-
-module.exports = {
-  handleMerge,
-  handleMergeComment,
-}
diff --git a/ci/github-script/package-lock.json b/ci/github-script/package-lock.json
index f9defdcf8f89..3409949f8c47 100644
--- a/ci/github-script/package-lock.json
+++ b/ci/github-script/package-lock.json
@@ -12,7 +12,6 @@
         "commander": "14.0.3"
       },
       "devDependencies": {
-        "@tsconfig/node24": "24.0.4",
         "@types/node": "24.13.3",
         "typescript": "7.0.2"
       }
@@ -630,13 +629,6 @@
         "@protobuf-ts/runtime": "^2.11.1"
       }
     },
-    "node_modules/@tsconfig/node24": {
-      "version": "24.0.4",
-      "resolved": "https://registry.npmjs.org/@tsconfig/node24/-/node24-24.0.4.tgz",
-      "integrity": "sha512-2A933l5P5oCbv6qSxHs7ckKwobs8BDAe9SJ/Xr2Hy+nDlwmLE1GhFh/g/vXGRZWgxBg9nX/5piDtHR9Dkw/XuA==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@types/node": {
       "version": "24.13.3",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
diff --git a/ci/github-script/package.json b/ci/github-script/package.json
index 84555f8dc372..c043dc6b1145 100644
--- a/ci/github-script/package.json
+++ b/ci/github-script/package.json
@@ -5,6 +5,7 @@
     "testsuite": "node --test",
     "test": "npm run typecheck && npm run testsuite"
   },
+  "type": "module",
   "//": [
     "Keep `@actions/core` and `@actions/github` in sync with",
     "https://github.com/actions/github-script/blob/main/package.json."
@@ -17,7 +18,6 @@
     "commander": "14.0.3"
   },
   "devDependencies": {
-    "@tsconfig/node24": "24.0.4",
     "@types/node": "24.13.3",
     "typescript": "7.0.2"
   }
diff --git a/ci/github-script/prepare.js b/ci/github-script/prepare.js
index 47ad4402925c..1ba90b5fe232 100644
--- a/ci/github-script/prepare.js
+++ b/ci/github-script/prepare.js
@@ -1,10 +1,11 @@
 // @ts-nocheck
-const { classify } = require('./supportedBranches.js')
-const { postReview, dismissReviews } = require('./reviews.js')
-const reviewKey = 'prepare'
-const supportedSystems = require('./supportedSystems.js')
+import { dismissReviews, postReview } from './reviews.js'
+import { classify } from './supportedBranches.js'
+import supportedSystems from './supportedSystems.js'
 
-module.exports = async ({ github, context, core, dry }) => {
+const reviewKey = 'prepare'
+
+export default async ({ github, context, core, dry }) => {
   const pull_number = context.payload.pull_request.number
 
   for (const retryInterval of [5, 10, 20, 40, 80]) {
@@ -65,7 +66,7 @@ module.exports = async ({ github, context, core, dry }) => {
       // commits between that base and head is the real base. We can query for this via GitHub's
       // REST API. There can be multiple candidates for the real base with the same number of
       // commits. In this case we pick the "best" candidate by a fixed ordering of branches,
-      // as defined in ./supportedBranches.js.
+      // as defined in ci/github-script/supportedBranches.js.
       //
       // These requests take a while, when comparing against the wrong release - they need
       // to look at way more than 10k commits in that case. Thus, we try to minimize the
diff --git a/ci/github-script/reviewers.js b/ci/github-script/reviewers.js
index 983ae3003eb9..31ae58c70d40 100644
--- a/ci/github-script/reviewers.js
+++ b/ci/github-script/reviewers.js
@@ -1,5 +1,5 @@
 // @ts-nocheck
-async function handleReviewers({
+export async function handleReviewers({
   github,
   context,
   core,
@@ -183,7 +183,3 @@ async function handleReviewers({
     teams_reached.size === 0
   )
 }
-
-module.exports = {
-  handleReviewers,
-}
diff --git a/ci/github-script/reviews.js b/ci/github-script/reviews.js
index 370b8e0656ef..584a035160f1 100644
--- a/ci/github-script/reviews.js
+++ b/ci/github-script/reviews.js
@@ -30,7 +30,13 @@ const reviewUsers = [
  *  reviewKey?: string,
  * }} DismissReviewsProps
  */
-async function dismissReviews({ github, context, core, dry, reviewKey }) {
+export async function dismissReviews({
+  github,
+  context,
+  core,
+  dry,
+  reviewKey,
+}) {
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
     core.warning('dismissReviews called outside of pull_request context')
@@ -170,7 +176,7 @@ async function dismissReviews({ github, context, core, dry, reviewKey }) {
  *  reviewKey: string,
  * }} PostReviewProps
  */
-async function postReview({
+export async function postReview({
   github,
   context,
   core,
@@ -262,8 +268,3 @@ async function postReview({
     }
   }
 }
-
-module.exports = {
-  dismissReviews,
-  postReview,
-}
diff --git a/ci/github-script/run b/ci/github-script/run
index 51ba00cc0d39..1fbdd0c24a65 100755
--- a/ci/github-script/run
+++ b/ci/github-script/run
@@ -1,4 +1,4 @@
-#!/usr/bin/env -S node --import ./run
+#!/usr/bin/env node
 import { execSync } from 'node:child_process'
 import { closeSync, mkdtempSync, openSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
@@ -112,7 +112,7 @@ program
   .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
   .argument('<pr>', 'Number of the Pull Request to run on')
   .action(async (owner, repo, pr, options) => {
-    const checkTargetBranch = (await import('./check-target-branch.ts')).default
+    const checkTargetBranch = (await import('./check-target-branch.ts')).checkTargetBranch
     await run(checkTargetBranch, owner, repo, pr, options)
   })
 
diff --git a/ci/github-script/supportedBranches.js b/ci/github-script/supportedBranches.js
index 5f25b99bbfc3..bcb3518cde5c 100755
--- a/ci/github-script/supportedBranches.js
+++ b/ci/github-script/supportedBranches.js
@@ -3,6 +3,8 @@
 #!nix-shell -i node -p nodejs
 */
 // @ts-nocheck
+import { resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
 
 const typeConfig = {
   master: ['development', 'primary'],
@@ -45,10 +47,13 @@ function classify(branch) {
   }
 }
 
-module.exports = { classify, split }
+export { classify, split }
 
 // If called directly via CLI, runs the following tests:
-if (!module.parent) {
+if (
+  process.argv[1] &&
+  fileURLToPath(import.meta.url) === resolve(process.argv[1])
+) {
   console.log('split(branch)')
   function testSplit(branch) {
     console.log(branch, split(branch))
diff --git a/ci/github-script/supportedSystems.js b/ci/github-script/supportedSystems.js
index 9776f3b796a2..d035c3fee230 100644
--- a/ci/github-script/supportedSystems.js
+++ b/ci/github-script/supportedSystems.js
@@ -1,5 +1,5 @@
 // @ts-nocheck
-module.exports = async ({ github, context, targetSha }) => {
+export default async ({ github, context, targetSha }) => {
   const { content, encoding } = (
     await github.rest.repos.getContent({
       ...context.repo,
diff --git a/ci/github-script/tsconfig.json b/ci/github-script/tsconfig.json
index 867c9169f9fe..215be461d5d3 100644
--- a/ci/github-script/tsconfig.json
+++ b/ci/github-script/tsconfig.json
@@ -14,7 +14,7 @@
     "strict": true,
     "esModuleInterop": true,
     "skipLibCheck": true,
-    "moduleResolution": "node16",
+    "moduleResolution": "nodenext",
 
     "allowImportingTsExtensions": true,
     "allowJs": true,
diff --git a/ci/github-script/withRateLimit.js b/ci/github-script/withRateLimit.js
index c5bcdc5984c7..59fb088ca3d7 100644
--- a/ci/github-script/withRateLimit.js
+++ b/ci/github-script/withRateLimit.js
@@ -1,7 +1,7 @@
 // @ts-nocheck
-module.exports = async ({ github, core, maxConcurrent = 1 }, callback) => {
-  const Bottleneck = require('bottleneck')
+import Bottleneck from 'bottleneck'
 
+export default async ({ github, core, maxConcurrent = 1 }, callback) => {
   const stats = {
     issues: 0,
     prs: 0,