diff --git a/.github/workflows/sqlite-runtime.yml b/.github/workflows/sqlite-runtime.yml
index def831809d..74f0cc8548 100644
--- a/.github/workflows/sqlite-runtime.yml
+++ b/.github/workflows/sqlite-runtime.yml
@@ -17,10 +17,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Exercise unavailable-runtime diagnostics, the first supported release,
-        # and new patches on both supported lines without hand-editing versions.
+        # Exercise unavailable-runtime diagnostics and rolling supported releases.
+        # Security floors prevent fallback to an older hosted-toolcache patch.
         # The repository-pinned Node 24 version also runs the complete test suite.
-        node: ["22.x", "24.22.1", "24.x", "26.x"]
+        node: ["^22.23.4", "24.22.1", "^24.22.1", "^26.12.1"]
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
diff --git a/tests/boundary/filesystem/ciRequiredLanes.test.ts b/tests/boundary/filesystem/ciRequiredLanes.test.ts
index 30fb9e7644..157c3454ee 100644
--- a/tests/boundary/filesystem/ciRequiredLanes.test.ts
+++ b/tests/boundary/filesystem/ciRequiredLanes.test.ts
@@ -1,6 +1,7 @@
 import { readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { expect, it } from "vitest";
+import { minVersion, subset } from "semver";
 import { parse } from "yaml";
 import { z } from "zod";
 import { executeWorkflowFixture } from "../../support/workflowGit.js";
@@ -35,6 +36,34 @@ const scopeFlags = async () =>
       ),
     ).CI_FLAGS;
 
+it("keeps every SQLite runtime selector inside the published package engine range", async () => {
+  const { engines } = z
+    .object({ engines: z.object({ node: z.string() }) })
+    .parse(
+      JSON.parse(
+        await readFile(
+          new URL("../../../package.json", import.meta.url),
+          "utf8",
+        ),
+      ),
+    );
+  const { strategy } = z
+    .object({
+      strategy: z.object({ matrix: z.object({ node: z.array(z.string()) }) }),
+    })
+    .parse((await workflow("sqlite-runtime.yml")).jobs.sqlite);
+  const selectors = strategy.matrix.node;
+  const pinned = (
+    await readFile(new URL("../../../.nvmrc", import.meta.url), "utf8")
+  ).trim();
+  expect(selectors).toContain(pinned);
+  expect(
+    new Set(selectors.map((selector) => minVersion(selector)?.major)),
+  ).toEqual(new Set([22, 24, 26]));
+  for (const selector of selectors)
+    expect(subset(selector, engines.node), selector).toBe(true);
+});
+
 it("binds SQLite compatibility jobs to the build's prepared runtime artifact and root layout", async () => {
   expect((await workflow()).jobs["sqlite-runtime"]?.if).toBe(
     "needs.changes.outputs.sqlite == 'true'",