diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 60ee217..9597146 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,8 @@ jobs:
 
       - uses: actions/setup-node@v7
         with:
-          node-version: 22
+          # 22.23.4 is the first 22.x that distrusts the compromised eMudhra intermediates (CVE-2026-111943). A bare `22` can reuse an older cached release.
+          node-version: 22.23.4
 
       - name: Syntax
         run: |
@@ -92,7 +93,8 @@ jobs:
 
       - uses: actions/setup-node@v7
         with:
-          node-version: 22
+          # 22.23.4 is the first 22.x that distrusts the compromised eMudhra intermediates (CVE-2026-111943). A bare `22` can reuse an older cached release.
+          node-version: 22.23.4
 
       - name: ffmpeg
         run: sudo apt-get update -qq && sudo apt-get install -y -qq ffmpeg
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0ece758..a8ec7c2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -89,3 +89,7 @@ Until the first release, changes are recorded under [Unreleased].
 - Headless Chrome gets 45 s to start instead of 20, since a busy CI runner starting several at once can take longer.
 - `references/visuals.md`: how to hide sticky headers before a capture, and a crop command that honours its offset (`sips -c` crops around the centre).
 - Plain replaces the template's previous look: Archivo, Newsreader and IBM Plex Mono on a white page, and figures (flows, steps, diagrams) on plain ground between two rules instead of a bordered dot grid.
+
+### Security
+
+- GitHub Actions pins Node.js to 22.23.4, the first 22.x release that distrusts the compromised eMudhra intermediate certificates ([CVE-2026-111943](https://www.cve.org/CVERecord?id=CVE-2026-111943), [Cloudflare](https://blog.cloudflare.com/emudhra-certificate-compromise/)). `actions/setup-node` with `node-version: 22` and no `check-latest` can keep an older cached 22.x. The minimum stays Node.js 22 (`package.json` engines `>=22`).