diff --git a/tests/unit/python/utils/install/test_node.py b/tests/unit/python/utils/install/test_node.py
index e1909daf71..e3e2d3d5fc 100644
--- a/tests/unit/python/utils/install/test_node.py
+++ b/tests/unit/python/utils/install/test_node.py
@@ -52,19 +52,23 @@ class TestNewestLts(unittest.TestCase):
 class TestTarballName(unittest.TestCase):
     def test_maps_x86_64(self) -> None:
         self.assertEqual(
-            node_mod.tarball_name("v24.22.1", "x86_64"),
+            node_mod.tarball_name("v24.22.1", "Linux", "x86_64"),
             "node-v24.22.1-linux-x64.tar.gz",
         )
 
     def test_maps_aarch64(self) -> None:
         self.assertEqual(
-            node_mod.tarball_name("v24.22.1", "aarch64"),
+            node_mod.tarball_name("v24.22.1", "Linux", "aarch64"),
             "node-v24.22.1-linux-arm64.tar.gz",
         )
 
     def test_raises_for_unknown_machine(self) -> None:
         with self.assertRaises(RuntimeError):
-            node_mod.tarball_name("v24.22.1", "riscv64")
+            node_mod.tarball_name("v24.22.1", "Linux", "riscv64")
+
+    def test_refuses_a_host_that_is_not_linux(self) -> None:
+        with self.assertRaises(RuntimeError):
+            node_mod.tarball_name("v24.22.1", "Darwin", "x86_64")
 
 
 class TestExpectedSha256(unittest.TestCase):
@@ -108,6 +112,7 @@ class TestInstallUpstreamLts(unittest.TestCase):
         with (
             mock.patch.object(node_mod, "download_file", side_effect=fake_download),
             mock.patch.object(node_mod, "_verify_signature"),
+            mock.patch.object(node_mod.platform, "system", return_value="Linux"),
             mock.patch.object(node_mod.platform, "machine", return_value="x86_64"),
             mock.patch.object(node_mod, "run_privileged") as extract,
             self.assertRaises(RuntimeError),
diff --git a/utils/install/node.py b/utils/install/node.py
index 87f4cb3d98..262ffa4e53 100644
--- a/utils/install/node.py
+++ b/utils/install/node.py
@@ -71,16 +71,23 @@ def newest_lts(index: list) -> str:
     raise RuntimeError(f"{DIST_URL}/index.json lists no LTS release")
 
 
-def tarball_name(version: str, machine: str) -> str:
-    """Return the Linux tarball name of a release for this machine.
+def tarball_name(version: str, system: str, machine: str) -> str:
+    """Return the Linux tarball name of a release for this host.
 
     Args:
         version: release version such as ``v24.22.1``.
+        system: ``platform.system()`` of the host.
         machine: ``platform.machine()`` of the host.
 
     Raises:
-        RuntimeError: Node.js publishes no Linux build for the machine.
+        RuntimeError: the host is not Linux, or Node.js publishes no Linux
+            build for the machine.
     """
+    if system != "Linux":
+        raise RuntimeError(
+            f"The upstream Node.js install supports Linux only; install a "
+            f"supported Node.js through the package manager on {system}."
+        )
     arch = ARCHITECTURES.get(machine)
     if arch is None:
         raise RuntimeError(f"No Node.js Linux build for machine {machine!r}")
@@ -136,7 +143,7 @@ def install_upstream_lts() -> str:
         index = workdir / "index.json"
         download_file(f"{DIST_URL}/index.json", str(index))
         version = newest_lts(_load_json(index))
-        name = tarball_name(version, platform.machine())
+        name = tarball_name(version, platform.system(), platform.machine())
         shasums = workdir / "SHASUMS256.txt"
         signature = workdir / "SHASUMS256.txt.sig"
         download_file(f"{DIST_URL}/{version}/SHASUMS256.txt", str(shasums))