diff --git a/.github/actions/bot-prelude/action.yml b/.github/actions/bot-prelude/action.yml
index e97bd7bc..c51d9819 100644
--- a/.github/actions/bot-prelude/action.yml
+++ b/.github/actions/bot-prelude/action.yml
@@ -83,7 +83,7 @@ runs:
     - name: Setup Node (for the Claude Code CLI the SDK spawns)
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: '22'
+        node-version: '22.23.4'
 
     - name: Install engine + Claude SDK/CLI
       uses: ./.github/actions/install-bot-engine
diff --git a/.github/workflows/engineer-bot-followup.yml b/.github/workflows/engineer-bot-followup.yml
index 31ffbcb1..9d3adca3 100644
--- a/.github/workflows/engineer-bot-followup.yml
+++ b/.github/workflows/engineer-bot-followup.yml
@@ -95,7 +95,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '20'
+          node-version: '22.23.4'
 
       - name: Setup JFrog
         uses: ./.github/actions/setup-jfrog
diff --git a/.github/workflows/engineer-bot.yml b/.github/workflows/engineer-bot.yml
index d5b07be4..89644344 100644
--- a/.github/workflows/engineer-bot.yml
+++ b/.github/workflows/engineer-bot.yml
@@ -74,7 +74,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '20'
+          node-version: '22.23.4'
 
       - name: Setup JFrog
         uses: ./.github/actions/setup-jfrog
diff --git a/.github/workflows/kernel-e2e.yml b/.github/workflows/kernel-e2e.yml
index 715a8ccd..bd1373cb 100644
--- a/.github/workflows/kernel-e2e.yml
+++ b/.github/workflows/kernel-e2e.yml
@@ -241,7 +241,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: 22.23.4
 
       - name: Set up Rust toolchain
         uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index c9aac5bc..cbd37b28 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -36,7 +36,7 @@ jobs:
           fi
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: 22.23.4
       - uses: ./.github/actions/setup-jfrog
       - name: Cache node modules
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
@@ -63,12 +63,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # LTS versions: 16/18/20 are the currently-supported floor; 22
-        # is the active LTS and 24 is the new LTS. Node 14 was dropped
-        # because the modern npm ecosystem (e.g. @dabh/diagnostics@2.0.7+
-        # via winston) ships ES2021 syntax (||=) that Node 14's V8 cannot
-        # parse. Node 14 has been EOL upstream since April 2023.
-        node-version: ['20', '22', '24', '26']
+        # Test the minimum patched release in each supported Node.js line.
+        node-version: ['22.23.4', '24.22.1', '26.12.1']
     env:
       cache-name: cache-node-modules
       NYC_REPORT_DIR: coverage_unit_node${{ matrix.node-version }}
@@ -120,7 +116,13 @@ jobs:
         # Matches the unit-test matrix so e2e catches Node-version-specific
         # behaviors (TLS/cipher defaults, native fetch interaction, lz4 ABI,
         # OAuth crypto APIs) that unit tests with mocked I/O can't surface.
-        node-version: ['20', '22', '24', '26']
+        include:
+          - node-version: '22.23.4'
+            node-suffix: '22_23_4'
+          - node-version: '24.22.1'
+            node-suffix: '24_22_1'
+          - node-version: '26.12.1'
+            node-suffix: '26_12_1'
     env:
       E2E_HOST: ${{ secrets.DATABRICKS_HOST }}
       E2E_PATH: ${{ secrets.TEST_PECO_WAREHOUSE_HTTP_PATH }}
@@ -129,7 +131,7 @@ jobs:
       # don't collide on shared E2E table names. Use underscore (not
       # hyphen) — hyphens aren't valid in SQL unquoted identifiers,
       # and tests build identifiers as `..._${E2E_TABLE_SUFFIX}`.
-      E2E_TABLE_SUFFIX: ${{ github.sha }}_node${{ matrix.node-version }}
+      E2E_TABLE_SUFFIX: ${{ github.sha }}_node${{ matrix.node-suffix }}
       E2E_CATALOG: peco
       E2E_SCHEMA: default
       E2E_VOLUME: e2etests
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f6b6df05..bf4b4f26 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Release History
 
+## Unreleased
+
+- **Breaking:** require Node.js versions containing the CVE-2026-111497 Brotli decoder fix: 22.23.4+, 24.22.1+, or 26.12.1+. Node.js 20, 23, and 25 are no longer supported because those end-of-life lines have no fix.
+
 ## 2.4.0
 
 - Upgrade the native kernel backend to 1.3.0, including security fixes in the SQL kernel bindings.
diff --git a/README.md b/README.md
index 0eab0fab..638cbf78 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@ The Databricks SQL Driver for Node.js is a Javascript driver for applications th
 
 ## Requirements
 
-- Node.js 20 or newer
+- Node.js 22.23.4+, 24.22.1+, 26.12.1+, or a later release
 
 ## Installation
 
diff --git a/SECURITY-OVERRIDES.md b/SECURITY-OVERRIDES.md
index 0334d1d2..f69ef967 100644
--- a/SECURITY-OVERRIDES.md
+++ b/SECURITY-OVERRIDES.md
@@ -55,7 +55,7 @@ This file documents the provenance and exit condition for each override. **When
 - **Class**: dev (mocha)
 - **Path**: `mocha → serialize-javascript`
 - **CVEs cleared**: GHSA-5c6j-r48x-rmvq (XSS via prototype pollution)
-- **Note**: the patched line requires Node ≥ 20, which is satisfied by `engines.node >= 20`.
+- **Note**: the patched line requires Node ≥ 20, which is satisfied by the supported Node 22.23.4 minimum.
 - **Exit**: mocha bumps its declared range to the patched line.
 
 ### `uuid: ^11.1.1`
diff --git a/package-lock.json b/package-lock.json
index deba52c0..a18a55c0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -50,7 +50,7 @@
         "typescript": "5.5.4"
       },
       "engines": {
-        "node": ">=20.0.0"
+        "node": ">=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1"
       },
       "optionalDependencies": {
         "@databricks/databricks-sql-kernel-darwin-arm64": "1.3.0",
diff --git a/package.json b/package.json
index 495c6ddc..6d6455df 100644
--- a/package.json
+++ b/package.json
@@ -8,8 +8,9 @@
     "example": "examples",
     "test": "tests"
   },
+  "//": "Node.js 20, 23, and 25 are EOL without fixes for CVE-2026-111497; the supported 22, 24, and 26 release lines require their first patched versions.",
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1"
   },
   "scripts": {
     "prepare": "npm run build",
diff --git a/tests/e2e/README.md b/tests/e2e/README.md
index 2e759d59..c75bc5e0 100644
--- a/tests/e2e/README.md
+++ b/tests/e2e/README.md
@@ -16,11 +16,11 @@ These tests run against a real Databricks SQL warehouse. They're invoked by `npm
 
 ## CI parallelism
 
-The `e2e-test` job in `.github/workflows/main.yml` runs as a matrix across Node 20/22/24/26. All entries point at the same workspace, catalog, schema, and volume.
+The `e2e-test` job in `.github/workflows/main.yml` runs against the minimum patched releases in each supported line: Node 22.23.4, 24.22.1, and 26.12.1. All entries point at the same workspace, catalog, schema, and volume.
 
 Per-test isolation is achieved by:
 
-- **Tables**: all DDL in tests is templated against `${E2E_TABLE_SUFFIX}`, which in CI is `${{ github.sha }}_node${{ matrix.node-version }}`. Underscores not hyphens — SQL unquoted identifiers don't allow `-`.
+- **Tables**: all DDL in tests is templated against `${E2E_TABLE_SUFFIX}`, which in CI is `${{ github.sha }}_node${{ matrix.node-suffix }}`. The matrix suffix uses underscores because dots and hyphens aren't valid within these SQL unquoted identifiers.
 - **Volume files**: `tests/e2e/staging_ingestion.test.ts` generates per-file `uuid.v4()` names. Multiple matrix entries can read/write the volume concurrently without collisions.
 
 No test creates or drops the shared catalog/schema/volume. If you add a test that does, you'll need to suffix-unique the resource name too — verify before merging.