diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2d6b57f..72ad563 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,15 +28,16 @@ jobs:
       matrix:
         # Google Chrome is preinstalled on all three runner images; no browser download needed.
         os: [ubuntu-latest, windows-latest, macos-15]
-        node: [20, 22]
+        # The supported LTS lines: the floor in package.json engines and the active LTS.
+        node: [22, 24]
         exclude:
           - os: macos-15
-            node: 20
+            node: 22
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref || github.ref }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node }}
           cache: npm
@@ -53,7 +54,7 @@ jobs:
       - name: Stealth tests (headed Chrome)
         if: runner.os != 'Linux'
         run: npm run test:stealth
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: test-results-${{ matrix.os }}-node${{ matrix.node }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3773691..e38b5b8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,8 +15,8 @@ jobs:
   tarball:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
diff --git a/.github/workflows/stealth-online.yml b/.github/workflows/stealth-online.yml
index 6ab82a8..b459d59 100644
--- a/.github/workflows/stealth-online.yml
+++ b/.github/workflows/stealth-online.yml
@@ -10,16 +10,17 @@ jobs:
   online:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
       - run: npm ci
       - name: selftest --online
         run: xvfb-run -a node bin/patchright-cli.js selftest --online || true
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: selftest-online-screenshots
           path: .patchright-cli/
+          include-hidden-files: true
           if-no-files-found: warn
diff --git a/.github/workflows/upstream-playwright-cli.yml b/.github/workflows/upstream-playwright-cli.yml
index 306dddb..b15597d 100644
--- a/.github/workflows/upstream-playwright-cli.yml
+++ b/.github/workflows/upstream-playwright-cli.yml
@@ -36,8 +36,8 @@ jobs:
       branch: ${{ steps.push.outputs.branch }}
       pushed: ${{ steps.push.outputs.pushed }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -56,11 +56,14 @@ jobs:
           done
           [ -f .roll/playwright-cli-report.md ] && cat .roll/playwright-cli-report.md >> "$GITHUB_STEP_SUMMARY"
           if [ "$code" != "0" ] && [ "$code" != "2" ]; then exit "$code"; fi
-      - uses: actions/upload-artifact@v4
+      # .roll/ is a dot directory: upload-artifact skips hidden files unless told otherwise, and
+      # the pull-request job cannot open a PR without this report, so a missing one fails here.
+      - uses: actions/upload-artifact@v7
         with:
           name: playwright-cli-report
           path: .roll/
-          if-no-files-found: ignore
+          include-hidden-files: true
+          if-no-files-found: error
       - name: Open an issue for a blocked merge
         if: steps.watch.outputs.classification == 'blocked'
         env:
@@ -115,10 +118,10 @@ jobs:
       CLASSIFICATION: ${{ needs.track.outputs.classification }}
       CI_RESULT: ${{ needs.test.result }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ needs.track.outputs.branch }}
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: playwright-cli-report
           path: .roll
diff --git a/.github/workflows/upstream-roll.yml b/.github/workflows/upstream-roll.yml
index e5aeaca..5d62625 100644
--- a/.github/workflows/upstream-roll.yml
+++ b/.github/workflows/upstream-roll.yml
@@ -47,8 +47,8 @@ jobs:
       too_fresh: ${{ steps.check.outputs.too_fresh }}
       open_issue: ${{ steps.issue.outputs.open_issue }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -84,8 +84,8 @@ jobs:
       branch: ${{ steps.push.outputs.branch }}
       pushed: ${{ steps.push.outputs.pushed }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -102,11 +102,14 @@ jobs:
           echo "classification=$(node -p "require('./.roll/result.json').classification")" >> "$GITHUB_OUTPUT"
           cat .roll/report.md >> "$GITHUB_STEP_SUMMARY"
           if [ "$code" != "0" ] && [ "$code" != "2" ]; then exit "$code"; fi
-      - uses: actions/upload-artifact@v4
+      # .roll/ is a dot directory: upload-artifact skips hidden files unless told otherwise, and
+      # the pull-request job cannot open a PR without this report, so a missing one fails here.
+      - uses: actions/upload-artifact@v7
         with:
           name: roll-report
           path: .roll/
-          if-no-files-found: ignore
+          include-hidden-files: true
+          if-no-files-found: error
       - name: Open an issue for a blocked roll
         if: steps.roll.outputs.classification == 'blocked'
         env:
@@ -159,10 +162,10 @@ jobs:
       CLASSIFICATION: ${{ needs.roll.outputs.classification }}
       CI_RESULT: ${{ needs.test.result }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ needs.roll.outputs.branch }}
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: roll-report
           path: .roll
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 22ce9d6..9e518ef 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,9 +12,13 @@ All notable changes to this project are documented here. The format follows [Kee
 - `recording-start` / `recording-stop` (new upstream commands): record what you do in the window and print it back as code. They carry the new `recorder-injection` warning, because the recorder puts a `__pw_recorder` binding on the page main world and an overlay element on every page until it is stopped.
 - `install --global` (alias `-g`) is a real flag now that the daemon takes it; it needs `--skills`, and says so instead of ignoring it.
 
+### Changed
+- Node.js 22 or newer is required: Node 20 reached end of life in April 2026. CI tests the two supported LTS lines, 22 and 24, and the workflows use the action releases that run on Node 24 (`checkout`, `setup-node` and `upload-artifact` v7, `download-artifact` v8).
+
 ### Fixed
 - Windows: a staged Chrome update no longer puts a version in the user agent that the browser is not serving. Chrome unpacks the next build into a second `<version>\` directory beside the running one and keeps serving the old build until it restarts, so the newest directory could disagree with the client hints (user agent `Chrome/153`, `uaFullVersion` `152.0.7977.82`) — the exact contradiction a detector looks for. With more than one directory the executable's own version resource decides.
 - Upstream roll: a repository with issues disabled (a fork has them off by default) no longer fails the `detect` job. The blocked-issue lookup warns and continues, and a blocked roll that cannot open an issue says so with the report in the job summary and the artifact.
+- Upstream workflows: the report artifact is uploaded again, so the pull request gets opened. `upload-artifact@v4` skips hidden files by default and the report lives in `.roll/`, so nothing was uploaded and the `pull-request` job died on the download; the playwright-cli watch has failed this way on every upstream change since playwright-cli 0.1.20. A missing report now fails the upload step itself. The manual online selftest had the same problem with `.patchright-cli/`.
 - `npm pack` from a working tree no longer picks up the ignored `skills/patchright-cli-workspace/` evaluation runs: `files` names `skills/patchright-cli` instead of `skills`. Release tarballs, built from a clean checkout, are unchanged.
 
 ### Upstream
diff --git a/README.md b/README.md
index f5bc7ce..21de6ca 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ Because the `patchright-cli` npm name belongs to an unrelated project, this one
 
 ## Requirements
 
-- Node.js 20 or newer.
+- Node.js 22 or newer.
 - Google Chrome (Microsoft Edge is the fallback). The bundled Chromium works but is detectable and warns.
 - Windows, macOS or Linux. Headless (the default) needs no display; `--headed` needs one (Linux: `xvfb-run -a`; macOS: a logged-in desktop session).
 
diff --git a/package-lock.json b/package-lock.json
index e90c576..4af1858 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -22,7 +22,7 @@
         "typescript": "^5.9.3"
       },
       "engines": {
-        "node": ">=20"
+        "node": ">=22"
       }
     },
     "node_modules/@esbuild/aix-ppc64": {
diff --git a/package.json b/package.json
index 7015e92..d40c4e8 100644
--- a/package.json
+++ b/package.json
@@ -8,7 +8,7 @@
   },
   "homepage": "https://github.com/b1zya/patchright-cli#readme",
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "author": {
     "name": "b1zya"
diff --git a/scripts/build.mjs b/scripts/build.mjs
index ae5f294..157fe58 100644
--- a/scripts/build.mjs
+++ b/scripts/build.mjs
@@ -7,7 +7,7 @@ await build({
   outfile: 'lib/cli.js',
   bundle: true,
   platform: 'node',
-  target: 'node20',
+  target: 'node22',
   format: 'cjs',
   sourcemap: false,
   logLevel: 'info',
diff --git a/skills/patchright-cli/SKILL.md b/skills/patchright-cli/SKILL.md
index eb0a910..7eed5df 100644
--- a/skills/patchright-cli/SKILL.md
+++ b/skills/patchright-cli/SKILL.md
@@ -412,7 +412,7 @@ patchright-cli doctor
 patchright-cli install --skills
 ```
 
-Requires Node.js 20+ and Google Chrome (or Microsoft Edge). Headless (the default) needs no display; `--headed` needs one (Linux: `xvfb-run -a`). Platform notes for Linux, Windows and macOS (displays, permissions, Gatekeeper, console windows) are in [references/platforms.md](references/platforms.md).
+Requires Node.js 22+ and Google Chrome (or Microsoft Edge). Headless (the default) needs no display; `--headed` needs one (Linux: `xvfb-run -a`). Platform notes for Linux, Windows and macOS (displays, permissions, Gatekeeper, console windows) are in [references/platforms.md](references/platforms.md).
 
 ## Example: log in with a persistent identity