diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a6dd3b5..fed9012 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,10 +8,18 @@ on:
 
 jobs:
   build:
+    # Named by major so required status checks survive version bumps.
+    name: build (${{ matrix.major }})
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [20, 22]
+        # Exact releases with the eMudhra CA fix: setup-node's manifest lags
+        # them, so "22" and "24" still resolve to unpatched builds.
+        include:
+          - major: 22
+            node-version: 22.23.4
+          - major: 24
+            node-version: 24.22.1
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index a9f540e..ffb1814 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -17,7 +17,9 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 24
+          # Exact release with the eMudhra CA fix: setup-node's manifest lags
+          # it, so "24" still resolves to an unpatched build.
+          node-version: 24.22.1
           registry-url: "https://registry.npmjs.org"
 
       - name: Install dependencies
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e8c795d..3719f76 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   on chat and email; phone takes `to_phone_number` and `from_phone_number`
   instead.
 
+### Changed
+
+- **Breaking**: requires Node.js 22 or newer (`engines` was `>=20`). Node.js 20
+  has no fix for the eMudhra certificate authority compromise below.
+
+### Security
+
+- The client uses Node's built-in `fetch`, which trusts the CA list bundled with
+  your Node.js release. Node.js releases before 22.23.4, 24.22.1 and 26.12.1
+  still trust the compromised eMudhra intermediate certificate authorities
+  disclosed in October 2026, which would let an attacker impersonate the
+  Gradient Labs API. Run Node.js 22.23.4, 24.22.1, 26.12.1 or later.
+
+## [0.1.2]
+
+### Added
+
+- `client.conversations.delete()` and `client.backOfficeTasks.delete()`.
+- `reason_code` on finishing a conversation.
+- `customer_support_platform_identifiers` on starting a conversation.
+
 ## [Unreleased]
 
 ### Added
diff --git a/README.md b/README.md
index 56d4f98..7fb48af 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,13 @@ Official client for the [Gradient Labs API](https://api.gradient-labs.ai). Writt
 in TypeScript, ships full type declarations and both ESM and CommonJS builds, and
 has **zero runtime dependencies** (it uses Node's built-in `fetch` and `crypto`).
 
-Requires **Node.js 20** or newer.
+Requires **Node.js 22** or newer.
+
+The client uses Node's built-in `fetch`, which verifies TLS certificates against
+the CA list bundled with your Node.js release. Releases before **22.23.4**,
+**24.22.1** and **26.12.1** still trust the compromised eMudhra intermediate
+certificate authorities disclosed in October 2026, so run one of those versions
+or later. Node.js 20 and earlier have no fix.
 
 ## Installation
 
diff --git a/package-lock.json b/package-lock.json
index 8652551..3abae61 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@gradientlabs/client",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@gradientlabs/client",
-      "version": "0.1.2",
+      "version": "0.1.3",
       "license": "MIT",
       "devDependencies": {
         "@eslint/js": "^9.7.0",
@@ -19,7 +19,7 @@
         "vitest": "^3.2.6"
       },
       "engines": {
-        "node": ">=20"
+        "node": ">=22"
       }
     },
     "node_modules/@esbuild/aix-ppc64": {
diff --git a/package.json b/package.json
index 6cf6d8c..f0bdd27 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,7 @@
   "description": "Official Node.js / TypeScript client for the Gradient Labs API",
   "type": "module",
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "exports": {
     ".": {