diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d35f62c..dfd2520 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,15 +15,18 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        node: [20, 22, 24]
+        # The Node lines the package supports (engines.node >=22): every
+        # LTS line still maintained by Node.js. Drop a line when it reaches
+        # end of life and raise engines.node in the same change.
+        node: [22, 24, 26]
         # Windows too: tools that read paths as globs (tsup's entries) break
         # on backslashes, and people develop the SDK there.
         include:
           - os: windows-latest
             node: 24
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node }}
           cache: npm
@@ -33,7 +36,7 @@ jobs:
       - name: Pack
         if: matrix.node == 24 && matrix.os == 'ubuntu-latest'
         run: npm pack
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: matrix.node == 24 && matrix.os == 'ubuntu-latest'
         with:
           name: versionone-agility-sdk-tarball
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 05bfb0b..4eeff72 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -41,12 +41,17 @@ jobs:
     # only a run in this environment can publish.
     environment: npm
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org
-      # `npm stage` needs npm 11.15.0 or later.
+          # Never restore a dependency cache in the job that holds the OIDC
+          # token (setup-node's own advice for trusted publishing).
+          package-manager-cache: false
+      # `npm stage` needs npm 11.15.0 or later. Node 24 has shipped npm 11.16+
+      # since 24.18.0 (June 2026); this keeps the floor if the runner's
+      # toolcache lags.
       - run: npm install -g npm@^11.15.0
       - run: npm ci
       - name: The tag names the version in package.json
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b8cc5c5..a106616 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,17 @@
 # Changelog
 
-## 1.0.0-alpha.5 (unreleased)
+## 1.0.0-alpha.6 (unreleased)
+
+### Breaking
+
+- **Node 22 or later** (`engines.node` is `>=22`, was `>=18`), and `dist`
+  is now built for Node 22+ (tsup's `target` was `node18`). Node 18
+  reached end of life in April 2025 and Node 20 in April 2026; neither
+  gets security fixes. CI tests the maintained LTS lines, 22, 24 and 26,
+  so a consumer on 18 or 20 was already untested. (The slack bot runs 24
+  and gh-v1 requires 22; agility-rooms runs in the browser.)
+
+## 1.0.0-alpha.5
 
 ### Added
 
diff --git a/README.md b/README.md
index 2b32750..c1e4eff 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # @versionone/agility-sdk
 
-TypeScript SDK for the Digital.ai Agility (formerly VersionOne) API. It works in Node (ESM or CommonJS) and the browser, ships its own types, and has no runtime dependencies.
+TypeScript SDK for the Digital.ai Agility (formerly VersionOne) API. It works in Node 22 or later (ESM or CommonJS) and the browser, ships its own types, and has no runtime dependencies.
 
 Not to be confused with `v1sdk`, the 2.x JavaScript SDK: this is a new API, not a compatible successor.
 
diff --git a/package.json b/package.json
index eacd2f0..29331e6 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "CHANGELOG.md"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "scripts": {
     "build": "tsup",
diff --git a/tsup.config.ts b/tsup.config.ts
index 0fb8c72..23d2913 100644
--- a/tsup.config.ts
+++ b/tsup.config.ts
@@ -6,5 +6,5 @@ export default defineConfig({
   dts: true,
   sourcemap: true,
   clean: true,
-  target: "node18"
+  target: "node22"
 });
\ No newline at end of file