diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5062e22f..3a90383c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **Published TypeScript declarations**: Generate the root plugin's declarations from `src/index.ts` and route ESM and CommonJS consumers to their respective `.d.ts` and `.d.cts` contracts, preserving the actual `id`, `setup`, and v1 `server` types. Previous packages declared a root type file without shipping it.
 - **Zero-directory globstar selection**: Match whole `**/` directory segments at any position against zero or more directories. Conventional includes such as `src/**/*.ts` now select direct source files as well as nested files, with the same exclusion precedence and path boundaries.
+- **Hono security floor**: Raise the qualified Hono override floor to 4.13.11 and resolve 4.13.13, addressing the `serveStatic` double-decoding middleware bypass in [GHSA-5r4p-p66f-jhc7](https://github.com/advisories/GHSA-5r4p-p66f-jhc7) (CVE-2026-111757). The SDK and peer dependency ranges, other dependency versions, and published Node.js minimum are unchanged.
 
 ### Changed
 
diff --git a/SECURITY.md b/SECURITY.md
index 526cf599..3b965a27 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -49,7 +49,7 @@ Track override decisions in [#379](https://github.com/Helweg/open-codebase-index
 
 | Selector | Replacement range | Security purpose |
 | --- | --- | --- |
-| `hono@>=4.0.0 <4.13.7` | `^4.13.7` | [GHSA-hxh3-vqpv-xpqv](https://github.com/advisories/GHSA-hxh3-vqpv-xpqv) |
+| `hono@>=4.0.0 <4.13.11` | `^4.13.11` | [GHSA-hxh3-vqpv-xpqv](https://github.com/advisories/GHSA-hxh3-vqpv-xpqv) and [GHSA-5r4p-p66f-jhc7](https://github.com/advisories/GHSA-5r4p-p66f-jhc7) |
 | `ip-address@>=10.0.0 <10.7.1` | `^10.7.1` | [GHSA-j6r3-76f7-8jcv](https://github.com/advisories/GHSA-j6r3-76f7-8jcv) and [GHSA-h3mg-xc3c-68pw](https://github.com/advisories/GHSA-h3mg-xc3c-68pw) |
 | `postcss@>=8.0.0 <8.5.26` | `^8.5.26` | Retain the sourceMappingURL map-file-disclosure floor from commit `5b0cf22`, including earlier PostCSS fixes |
 | `vite@>=8.0.0 <8.0.16` | `^8.0.16` | [GHSA-v6wh-96g9-6wx3](https://github.com/advisories/GHSA-v6wh-96g9-6wx3) and [GHSA-fx2h-pf6j-xcff](https://github.com/advisories/GHSA-fx2h-pf6j-xcff) |
diff --git a/package-lock.json b/package-lock.json
index 92bdd455..f60493f0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6185,9 +6185,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.13.7",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz",
-      "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==",
+      "version": "4.13.13",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.13.tgz",
+      "integrity": "sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
diff --git a/package.json b/package.json
index 68b1bc38..d579a146 100644
--- a/package.json
+++ b/package.json
@@ -128,7 +128,7 @@
     "vitest": "^5.0.0"
   },
   "overrides": {
-    "hono@>=4.0.0 <4.13.7": "^4.13.7",
+    "hono@>=4.0.0 <4.13.11": "^4.13.11",
     "ip-address@>=10.0.0 <10.7.1": "^10.7.1",
     "postcss@>=8.0.0 <8.5.26": "^8.5.26",
     "vite@>=8.0.0 <8.0.16": "^8.0.16",