diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index c709345..a0ec90a 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -29,8 +29,8 @@ jobs:
       RUN_MSSQL_JOBS: 0
       RUN_WINDOWS_JOBS: 0
 
-      PRIMARY_PHP_VERSION: '8.2'
-      PHP_VERSION_MATRIX: '["8.2", "8.3", "8.4", "8.5"]'
+      PRIMARY_PHP_VERSION: '8.3'
+      PHP_VERSION_MATRIX: '["8.3", "8.4", "8.5"]'
 
   # phpBB 4.0 (master): the same tests with the framework's master branch
   call-tests-master:
@@ -45,8 +45,8 @@ jobs:
       RUN_PGSQL_JOBS: 0
       RUN_MSSQL_JOBS: 0
       RUN_WINDOWS_JOBS: 0
-      PRIMARY_PHP_VERSION: '8.2'
-      PHP_VERSION_MATRIX: '["8.2", "8.3", "8.4", "8.5"]'
+      PRIMARY_PHP_VERSION: '8.3'
+      PHP_VERSION_MATRIX: '["8.3", "8.4", "8.5"]'
 
   # EPV (Extension Pre Validator), failing on any Fatal or Error finding not
   # listed in .github/epv-allowed.txt
@@ -110,13 +110,14 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.2'
+          php-version: '8.3'
+          update: true
           extensions: dom, intl, mbstring, mysqli, pdo_mysql, pdo_pgsql, pdo_sqlite, pgsql, sqlite3
           coverage: none
 
       - name: Install phpBB dependencies
         working-directory: ./phpBB3
-        run: .github/setup-phpbb.sh none 8.2 1
+        run: .github/setup-phpbb.sh none 8.3 1
 
       - name: Run PHPUnit
         working-directory: ./phpBB3/phpBB/ext/phpbbmodders/knowledgebase
diff --git a/composer.json b/composer.json
index dd25b53..10496a7 100644
--- a/composer.json
+++ b/composer.json
@@ -32,7 +32,7 @@
 		}
 	],
 	"require": {
-		"php": ">=8.2",
+		"php": ">=8.3.36",
 		"phpbb/phpbb": ">=3.3.19 <4.1.0",
 		"composer/installers": "~2.0"
 	},
diff --git a/docs/phpbb-4.0-compatibility.md b/docs/phpbb-4.0-compatibility.md
index 9ac5a18..46fd862 100644
--- a/docs/phpbb-4.0-compatibility.md
+++ b/docs/phpbb-4.0-compatibility.md
@@ -11,8 +11,8 @@ From `composer.json`:
 - `require.phpbb/phpbb`: `>=3.3.19 <4.1.0`
 - `extra.soft-require.phpbb/phpbb`: `>=3.3.19,<4.1.0@dev` — phpBB 3.3.x and 4.0.x,
   including 4.0 development builds. (Until 10/12/2026 both said `<4.0.0`.)
-- `require.php`: `>=8.2` (also enforced when the extension is enabled, by `ext.php`; it matches phpBB
-  4.0's own PHP floor and the version the CI job tests)
+- `require.php`: `>=8.3.36` (also enforced when the extension is enabled, by `ext.php`,
+  due to security fixes; CI uses the latest PHP 8.3 patch release)
 
 phpBB 4.0.x is still in development, so specifics below are marked
 verified vs. pending as they're confirmed against real code/changelog
@@ -161,12 +161,10 @@ rendered, and an article submitted through the posting form was saved without er
    size. It now stores `$upload_file->get('filesize')`. A single-request upload (70 bytes) and the
    3.3.x test board give the same result as before.
 
-**Declared support.** The PHP floor was raised from 8.0 to 8.2 on 10/12/2026. The extension uses
-nothing specific to 8.1 or 8.2 (it linted clean and passed its unit tests on PHP 8.0.30), so this is
-a policy choice, not a technical need: phpBB 4.0 requires PHP 8.2 itself, and the CI job that runs
-uses 8.2 (the matrix lists 8.2 to 8.5, but with the database jobs switched off only the primary job
-runs; 8.4 and 8.5 were run locally), so the stated floor is what CI tests. A 3.3.x board on PHP 8.0 or 8.1
-can no longer enable this extension. The phpBB constraints were then widened to `<4.1.0`, so
+**Declared support.** The PHP floor was raised from 8.0 to 8.2 on 10/12/2026, then to 8.3.36
+on 10/22/2026 due to security fixes. The CI matrix lists PHP 8.3 through 8.5 and uses PHP 8.3
+as its primary version. Boards running PHP below 8.3.36 cannot enable this extension.
+The phpBB constraints were widened to `<4.1.0`, so
 the extension can be enabled on 4.0.x; it was enabled on a 4.0.0-a3-dev board with the constraints
 as shipped. 4.0 is still a development release, so "supported" here means "checked as below", not a
 promise about later 4.0 builds.
diff --git a/ext.php b/ext.php
index 1d2dd92..9655c9a 100644
--- a/ext.php
+++ b/ext.php
@@ -19,8 +19,8 @@ class ext extends \phpbb\extension\base
 	/** Minimum phpBB version - 3.3.19 carries the security fixes from 3.3.17-3.3.19 */
 	public const MIN_PHPBB_VERSION = '3.3.19';
 
-	/** Minimum PHP version - phpBB 4.0 itself needs 8.2, and the tests run on 8.2 and newer */
-	public const MIN_PHP_VERSION = '8.2.0';
+	/** Minimum PHP version - 8.3.36 includes security fixes. */
+	public const MIN_PHP_VERSION = '8.3.36';
 
 	/** The original package this extension can take over from; it must be disabled first. */
 	public const ORIGINAL_EXTENSION = 'sheer/knowledgebase';
@@ -57,23 +57,23 @@ public function is_enableable()
 	}
 
 	/**
-	 * Require phpBB 3.3.19
+	 * Require phpBB 3.3.19 due to several security fixes in the phpBB software.
 	 *
 	 * @return bool
 	 */
 	public function check_phpbb_version()
 	{
-		return phpbb_version_compare(PHPBB_VERSION, self::MIN_PHPBB_VERSION, '>=');
+		return phpbb_version_compare(PHPBB_VERSION, '3.3.19', '>=');
 	}
 
 	/**
-	 * Require PHP 8.2
+	 * Requires PHP 8.3.36 due to security fixes.
 	 *
 	 * @return bool
 	 */
 	public function check_php_version()
 	{
-		return self::php_version_meets_minimum(PHP_VERSION);
+		return PHP_VERSION_ID >= 80336;
 	}
 
 	/**
diff --git a/tests/kb_declared_support_test.php b/tests/kb_declared_support_test.php
index 8f96a3b..eb3150d 100644
--- a/tests/kb_declared_support_test.php
+++ b/tests/kb_declared_support_test.php
@@ -30,15 +30,15 @@ private function composer(): array
 		return json_decode(file_get_contents(self::ROOT . '/composer.json'), true, 512, JSON_THROW_ON_ERROR);
 	}
 
-	public function test_composer_requires_php_8_2_or_newer()
+	public function test_composer_requires_php_8_3_36_or_newer()
 	{
-		$this->assertSame('>=8.2', $this->composer()['require']['php']);
+		$this->assertSame('>=8.3.36', $this->composer()['require']['php']);
 	}
 
 	public function test_the_extension_refuses_to_enable_below_the_same_minimum()
 	{
-		$this->assertSame('8.2.0', ext::MIN_PHP_VERSION);
-		$this->assertSame('>=' . substr(ext::MIN_PHP_VERSION, 0, 3), $this->composer()['require']['php']);
+		$this->assertSame('8.3.36', ext::MIN_PHP_VERSION);
+		$this->assertSame('>=' . ext::MIN_PHP_VERSION, $this->composer()['require']['php']);
 	}
 
 	/** @dataProvider php_versions */
@@ -53,9 +53,12 @@ public function php_versions(): array
 			'8.0 is too old'            => ['8.0.30', false],
 			'8.1 is too old'            => ['8.1.31', false],
 			'8.2 development build'     => ['8.2.0-dev', false],
-			'first 8.2 release'         => ['8.2.0', true],
-			'8.2 patch release'         => ['8.2.27', true],
-			'8.3'                       => ['8.3.0', true],
+			'first 8.2 release'         => ['8.2.0', false],
+			'8.2 patch release'         => ['8.2.27', false],
+			'first 8.3 release'         => ['8.3.0', false],
+			'below security minimum'    => ['8.3.35', false],
+			'security minimum'          => ['8.3.36', true],
+			'later 8.3 patch release'   => ['8.3.37', true],
 			'8.4'                       => ['8.4.26', true],
 			'a future major version'    => ['9.0.0', true],
 		];
@@ -100,7 +103,7 @@ public function test_the_compatibility_notes_state_the_same_php_floor()
 	{
 		$notes = file_get_contents(self::ROOT . '/docs/phpbb-4.0-compatibility.md');
 
-		$this->assertStringContainsString('`require.php`: `>=8.2`', $notes);
+		$this->assertStringContainsString('`require.php`: `>=8.3.36`', $notes);
 		$this->assertStringNotContainsString('`>=8.0`', $notes);
 	}
 }
diff --git a/tests/kb_ext_enableable_test.php b/tests/kb_ext_enableable_test.php
index f325bc0..3c40a69 100644
--- a/tests/kb_ext_enableable_test.php
+++ b/tests/kb_ext_enableable_test.php
@@ -27,13 +27,21 @@ private function ext(bool $original_enabled): ext
 		$container = $this->createMock(\Symfony\Component\DependencyInjection\ContainerInterface::class);
 		$container->method('get')->willReturnCallback(fn($id) => ['language' => $language, 'ext.manager' => $manager][$id]);
 
-		$ext = (new \ReflectionClass(ext::class))->newInstanceWithoutConstructor();
+		$ext = $this->getMockBuilder(ext::class)->disableOriginalConstructor()->onlyMethods(['check_php_version'])->getMock();
+		$ext->method('check_php_version')->willReturn(true);
 		$property = new \ReflectionProperty(\phpbb\extension\base::class, 'container');
 		$property->setValue($ext, $container);
 
 		return $ext;
 	}
 
+	public function test_php_security_minimum()
+	{
+		$this->assertFalse(ext::php_version_meets_minimum('8.3.35'));
+		$this->assertTrue(ext::php_version_meets_minimum('8.3.36'));
+		$this->assertTrue(ext::php_version_meets_minimum('8.4.0'));
+	}
+
 	public function test_it_can_be_enabled_when_the_original_package_is_not_enabled()
 	{
 		$this->assertTrue($this->ext(false)->is_enableable());