diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0dcecfd..3390054 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -125,11 +125,11 @@ jobs:
             ~/Library/Caches/Coursier/v1
           key: ${{ runner.os }}-sbt-cache-v2-${{ hashFiles('**/*.sbt') }}-${{ hashFiles('project/build.properties') }}
 
-      - name: Setup NodeJS v14 LTS
+      - name: Setup NodeJS v16 LTS
         if: matrix.project == 'rootJS' && matrix.jsenv == 'NodeJS'
         uses: actions/setup-node@v2.4.0
         with:
-          node-version: 14
+          node-version: 16
 
       - name: Check that workflows are up to date
         run: 'sbt ''project ${{ matrix.project }}'' ''++${{ matrix.scala }}'' ''set Global / useJSEnv := JSEnv.${{ matrix.jsenv }}'' ''project /'' githubWorkflowCheck'
diff --git a/build.sbt b/build.sbt
index 228b65f..0b75b6b 100644
--- a/build.sbt
+++ b/build.sbt
@@ -36,8 +36,8 @@ ThisBuild / crossScalaVersions := Seq("3.1.3", "2.12.16", "2.13.8")
 ThisBuild / githubWorkflowBuildPreamble ++= Seq(
   WorkflowStep.Use(
     UseRef.Public("actions", "setup-node", "v2.4.0"),
-    name = Some("Setup NodeJS v14 LTS"),
-    params = Map("node-version" -> "14"),
+    name = Some("Setup NodeJS v16 LTS"),
+    params = Map("node-version" -> "16"),
     cond = Some("matrix.project == 'rootJS' && matrix.jsenv == 'NodeJS'")
   )
 )
diff --git a/crypto/js/src/main/scala/org/http4s/crypto/HmacKeyGenPlatform.scala b/crypto/js/src/main/scala/org/http4s/crypto/HmacKeyGenPlatform.scala
index 508d91e..eb4aaea 100644
--- a/crypto/js/src/main/scala/org/http4s/crypto/HmacKeyGenPlatform.scala
+++ b/crypto/js/src/main/scala/org/http4s/crypto/HmacKeyGenPlatform.scala
@@ -33,20 +33,23 @@ private[crypto] trait HmacKeyGenCompanionPlatform {
       new UnsealedHmacKeyGen[F] {
         import facade.node._
 
-        override def generateKey[A <: HmacAlgorithm](algorithm: A): F[SecretKey[A]] =
+        override def generateKey[A <: HmacAlgorithm](algorithm: A): F[SecretKey[A]] = {
+          val options = new GenerateKeyOptions {
+            val length = algorithm.minimumKeyLength * java.lang.Byte.SIZE
+          }
           Some(F)
             .collect { case f: Async[F] => f }
             .fold {
               F.delay[SecretKey[A]] {
                 val key =
-                  crypto.generateKeySync("hmac", GenerateKeyOptions(algorithm.minimumKeyLength))
+                  crypto.generateKeySync("hmac", options)
                 SecretKeySpec(ByteVector.view(key.`export`()), algorithm)
               }
             } { F =>
               F.async_[SecretKey[A]] { cb =>
                 crypto.generateKey(
                   "hmac",
-                  GenerateKeyOptions(algorithm.minimumKeyLength),
+                  options,
                   (err, key) =>
                     cb(
                       Option(err)
@@ -55,6 +58,7 @@ private[crypto] trait HmacKeyGenCompanionPlatform {
                 )
               }
             }
+        }
 
       }
     else
diff --git a/crypto/js/src/main/scala/org/http4s/crypto/facade/node/crypto.scala b/crypto/js/src/main/scala/org/http4s/crypto/facade/node/crypto.scala
index 8850c46..8c0b240 100644
--- a/crypto/js/src/main/scala/org/http4s/crypto/facade/node/crypto.scala
+++ b/crypto/js/src/main/scala/org/http4s/crypto/facade/node/crypto.scala
@@ -52,9 +52,8 @@ private[crypto] trait crypto extends js.Any {
 
 }
 
-@js.native
-private[crypto] trait GenerateKeyOptions extends js.Any
-private[crypto] object GenerateKeyOptions {
-  def apply(length: Int): GenerateKeyOptions =
-    js.Dynamic.literal(length = length).asInstanceOf[GenerateKeyOptions]
+private[crypto] trait GenerateKeyOptions extends js.Object {
+  val length: Int
 }
+
+private[crypto] object GenerateKeyOptions
diff --git a/crypto/shared/src/test/scala/org/http4s/crypto/HashSuite.scala b/crypto/shared/src/test/scala/org/http4s/crypto/HashSuite.scala
index a0d741f..878d975 100644
--- a/crypto/shared/src/test/scala/org/http4s/crypto/HashSuite.scala
+++ b/crypto/shared/src/test/scala/org/http4s/crypto/HashSuite.scala
@@ -56,7 +56,6 @@ final class HashSuite extends CatsEffectSuite {
   if (Set("JVM", "NodeJS").contains(BuildInfo.runtime))
     tests[SyncIO]
 
-  if (BuildInfo.runtime != "JVM")
-    tests[IO]
+  tests[IO]
 
 }
diff --git a/crypto/shared/src/test/scala/org/http4s/crypto/HmacSuite.scala b/crypto/shared/src/test/scala/org/http4s/crypto/HmacSuite.scala
index 15009c5..ae642c8 100644
--- a/crypto/shared/src/test/scala/org/http4s/crypto/HmacSuite.scala
+++ b/crypto/shared/src/test/scala/org/http4s/crypto/HmacSuite.scala
@@ -58,22 +58,18 @@ final class HmacSuite extends CatsEffectSuite {
       HmacKeyGen[F].generateKey(algorithm).map {
         case SecretKeySpec(key, keyAlgorithm) =>
           assertEquals(algorithm, keyAlgorithm)
-          assert(key.size >= algorithm.minimumKeyLength)
+          assert(clue(key.size) >= clue(algorithm.minimumKeyLength))
       }
     }
 
   if (Set("JVM", "NodeJS").contains(BuildInfo.runtime))
     tests[SyncIO]
 
-  if (BuildInfo.runtime != "JVM")
-    tests[IO]
+  tests[IO]
 
-  if (BuildInfo.runtime == "JVM")
+  if (Set("JVM", "NodeJS").contains(BuildInfo.runtime))
     List(SHA1, SHA256, SHA512).foreach(testGenerateKey[SyncIO])
 
-  if (!Set("JVM", "NodeJS").contains(
-      BuildInfo.runtime
-    )) // Disabled until testing against Node 16
-    List(SHA1, SHA256, SHA512).foreach(testGenerateKey[IO])
+  List(SHA1, SHA256, SHA512).foreach(testGenerateKey[IO])
 
 }