diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3919933..8f7a640 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -39,7 +39,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: "24.22.1"
       - name: Set up Rust from repository toolchain
         shell: bash
         run: |
@@ -69,7 +69,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: "24.22.1"
       - name: Start PostgreSQL
         run: |
           sudo systemctl start postgresql.service
@@ -93,7 +93,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: "24.22.1"
       - name: Install dependencies
         run: npm install --omit=optional --ignore-scripts --no-audit --no-fund --package-lock=false
       - name: Download all binary artifacts
@@ -136,23 +136,23 @@ jobs:
           - os: ubuntu-latest
             platform: linux-x64-gnu
             shell: bash
-            node: 20
+            node: "22.23.4"
           - os: ubuntu-24.04-arm
             platform: linux-arm64-gnu
             shell: bash
-            node: 20
+            node: "22.23.4"
           - os: macos-14        # arm64
             platform: darwin-arm64
             shell: bash
-            node: 20
+            node: "22.23.4"
           - os: macos-15-intel  # x64
             platform: darwin-x64
             shell: bash
-            node: 20
+            node: "22.23.4"
           - os: windows-latest
             platform: windows-x64
             shell: pwsh
-            node: 20
+            node: "22.23.4"
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1a4ec59..8e052df 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- **CI runs on patched Node.js** — build, test and pack use Node.js `24.22.1`; the
+  platform smoke tests use `22.23.4`. Both are the October 2026 security releases.
+  CI used Node.js 20 before, which is end-of-life and gets no security fixes.
+
 ## [0.2.2] - 2026-10-21
 
 ### Changed