diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 098a53d..20d83af 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -7,9 +7,10 @@ jobs:
   tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
-          node-version: '20'
+          node-version: '24'
+          check-latest: true
       - name: Run test suite
         run: bash test/run.sh
diff --git a/CHANGELOG.md b/CHANGELOG.md
index dbde3b6..61f4899 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,10 @@ template, or tooling — not the issue data a given report happens to show.
 - `install.sh` and `export.sh` moved to `tools/`. The engine itself did not move, so
   existing `~/bin/fp-report` symlinks keep working — only the install/export commands
   gain a `tools/` prefix.
+- **CI runs the suite on Node 24, not Node 20.** Node 20 is end-of-life and has no release
+  fixing CVE-2026-111497 (Brotli decoder). `check-latest` makes setup-node take the newest
+  24.x rather than the runner's cached one, which was 24.21.0, older than the fixed 24.22.1.
+  `actions/checkout` and `actions/setup-node` move from v4 to v7.
 
 ### Fixed
 - **`fp-report-deploy` works when installed as a symlink** (`tools/install.sh`, a bin
diff --git a/README.md b/README.md
index cdece9d..6b3bf36 100644
--- a/README.md
+++ b/README.md
@@ -665,7 +665,7 @@ bash test/run.sh        # the whole suite; exits non-zero if anything fails
 through the real engine with `--issues-file` and asserts on the produced HTML. It needs
 `bash` + `python3`; `node` is optional and only unlocks the JS-level checks (they skip
 silently without it). CI runs the same one line on every push
-(`.github/workflows/tests.yml`, Node 20).
+(`.github/workflows/tests.yml`, Node 24).
 
 What it covers: placeholder replacement and injection safety (a hostile issue title must
 not break out of the embedded JSON), prefix/title/theme/status/taxonomy injection and