diff --git a/.changeset/brotli-patched-node.md b/.changeset/brotli-patched-node.md
new file mode 100644
index 00000000..7296affb
--- /dev/null
+++ b/.changeset/brotli-patched-node.md
@@ -0,0 +1,11 @@
+---
+"nostream": patch
+---
+
+chore(deps): build and test on Node 24.22.1, which patches the Brotli decoder
+
+CVE-2026-111497 is an out-of-bounds write in every Brotli decoder up to 1.2.0,
+reachable by anything that decodes a `br` stream. Node bundles its own decoder,
+so the fix is the Node release: 24.22.1 on the 24 line. `.nvmrc` and both
+Dockerfile stages move from floating `node:24-alpine` to a pinned
+`node:24.22.1-alpine`.
diff --git a/.nvmrc b/.nvmrc
index a3b7a31e..474d750b 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-v24.14.1
+v24.22.1
diff --git a/Dockerfile b/Dockerfile
index 2a40cbfb..48e3b681 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 ARG PNPM_VERSION=10.33.0
 
-FROM node:24-alpine AS build
+FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS build
 
 ARG PNPM_VERSION
 
@@ -14,7 +14,7 @@ COPY . .
 
 RUN pnpm build
 
-FROM node:24-alpine
+FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 
 ARG PNPM_VERSION