diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f85c77b..7b38e04 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,13 +8,13 @@ jobs:
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: "26.12.1"
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm release:verify
       - run: pnpm bench:size:research
       - uses: astral-sh/setup-uv@v6
         with:
-          version: '0.12.10'
+          version: "0.12.10"
       - run: uv sync --frozen
       - run: uv run python -m unittest training.test_export training.test_data_sources training.test_quality training.test_calibration training.test_experiment_objectives training.test_release_candidate training.test_navigation training.test_navigation_augmentation training.test_evaluate_navigation training.test_typo
diff --git a/.node-version b/.node-version
new file mode 100644
index 0000000..63f87c2
--- /dev/null
+++ b/.node-version
@@ -0,0 +1 @@
+26.12.1
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..b6f27f1
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1 @@
+engine-strict=true
diff --git a/README.md b/README.md
index 6f37211..ccbd08b 100644
--- a/README.md
+++ b/README.md
@@ -42,7 +42,7 @@ Rebuild the index when your menu changes. You do not need to assemble separate n
 
 ## Try it locally
 
-Use Node.js 22.12+ and pnpm 12.4.1 in this repository:
+Use Node.js 26.12.1+ on the 26.x line and pnpm 12.4.1. Vercel builds may use patched Node.js 24.22.1+ on the 24.x line until Node 26 is supported there. These minimums include the CVE-2026-111497 Brotli decoder fix; `.node-version` and CI select 26.12.1:
 
 ```sh
 pnpm install --frozen-lockfile
diff --git a/package.json b/package.json
index 9a35653..675816d 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,8 @@
     "bench:size:research": "node --import tsx bench/size-research.ts",
     "bench:browser": "node --import tsx bench/browser.ts",
     "release:verify": "pnpm check && pnpm test:contracts && pnpm test:parity && pnpm build && pnpm bench:size",
-    "test:demo": "node --import tsx bench/demo-check.ts"
+    "test:demo": "node --import tsx bench/demo-check.ts",
+    "preinstall": "node scripts/check-node.mjs"
   },
   "devDependencies": {
     "@types/node": "24.10.1",
@@ -23,5 +24,8 @@
     "tsx": "4.21.0",
     "typescript": "5.9.3",
     "vite": "7.3.5"
+  },
+  "engines": {
+    "node": "^24.22.1 || ^26.12.1"
   }
 }
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index a30bb51..e0d0650 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -2,3 +2,6 @@ packages:
   - packages/core
 allowBuilds:
   esbuild: true
+
+# Reject Node runtimes without the CVE-2026-111497 security fix.
+engineStrict: true
diff --git a/scripts/check-node.mjs b/scripts/check-node.mjs
new file mode 100644
index 0000000..ba327fe
--- /dev/null
+++ b/scripts/check-node.mjs
@@ -0,0 +1,16 @@
+// CVE-2026-111497 is fixed in these Node.js security releases.
+const [major, minor, patch] = process.versions.node.split(".").map(Number);
+const minimum = new Map([
+  [24, [22, 1]],
+  [26, [12, 1]],
+]).get(major);
+if (
+  !Number.isInteger(patch) ||
+  !minimum ||
+  minor < minimum[0] ||
+  (minor === minimum[0] && patch < minimum[1])
+) {
+  throw new Error(
+    "CVE-2026-111497: use Node.js 26.12.1+ on the 26.x line (or patched Node.js 24.22.1+ where Vercel requires 24.x).",
+  );
+}