diff --git a/.github/workflows/pr-dequeued.yml b/.github/workflows/pr-dequeued.yml
index 0c47c9dc7..25260c7aa 100644
--- a/.github/workflows/pr-dequeued.yml
+++ b/.github/workflows/pr-dequeued.yml
@@ -21,8 +21,23 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REASON: ${{ github.event.reason }}
-          USER: ${{ github.event.pull_request.user.login }}
         run: |
-          echo "@$USER The pull request was removed from the merge queue (\`$REASON\`)." \
+          # Mention whoever added the PR to the merge queue rather than the PR author, who may be a
+          # bot such as Dependabot. The `dequeued` event payload doesn't identify the enqueuer, so
+          # look them up in the most recent `AddedToMergeQueueEvent` on the PR's timeline.
+          enqueuer=$(gh api graphql \
+            -F number="$PR_NUMBER" \
+            -f query='
+              query($number: Int!) {
+                repository(owner: "github", name: "codeql-action") {
+                  pullRequest(number: $number) {
+                    timelineItems(itemTypes: [ADDED_TO_MERGE_QUEUE_EVENT], last: 1) {
+                      nodes { ... on AddedToMergeQueueEvent { enqueuer { login } } }
+                    }
+                  }
+                }
+              }' \
+            --jq '.data.repository.pullRequest.timelineItems.nodes[0].enqueuer.login')
+          echo "@$enqueuer The pull request was removed from the merge queue (\`$REASON\`)." \
             "Please resolve any issues if required and enqueue the PR again." |
             gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"
diff --git a/README.md b/README.md
index 8c4fc4663..d738adcab 100644
--- a/README.md
+++ b/README.md
@@ -76,7 +76,6 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n
 | `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
 | `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
 | `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
-| `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |
 
 See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).
 
diff --git a/lib/entry-points.js b/lib/entry-points.js
index 013ed8f0e..73bea7d94 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -169427,7 +169427,7 @@ var semver = __toESM(require_semver2());
 
 // src/api-compatibility.json
 var maximumVersion = "3.23";
-var minimumVersion = "3.18";
+var minimumVersion = "3.19";
 
 // src/json/index.ts
 function parseString(data) {
@@ -177004,9 +177004,9 @@ async function getCombinedTracerConfig(logger2, codeql, config) {
 // src/codeql.ts
 var cachedCodeQL = void 0;
 var CODEQL_MINIMUM_VERSION = "2.20.7";
-var CODEQL_NEXT_MINIMUM_VERSION = "2.21.3";
-var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.17";
-var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-09-24";
+var CODEQL_NEXT_MINIMUM_VERSION = "2.22.4";
+var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.18";
+var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-10-16";
 var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 function isDiskConfigurationError(e) {
   if (!(e instanceof Error)) {
diff --git a/src/api-compatibility.json b/src/api-compatibility.json
index c1122fb2a..83ff180db 100644
--- a/src/api-compatibility.json
+++ b/src/api-compatibility.json
@@ -1 +1 @@
-{"maximumVersion":"3.23","minimumVersion":"3.18"}
+{"maximumVersion":"3.23","minimumVersion":"3.19"}
diff --git a/src/codeql.ts b/src/codeql.ts
index 28ba2243e..c1a8f4f34 100644
--- a/src/codeql.ts
+++ b/src/codeql.ts
@@ -260,17 +260,17 @@ const CODEQL_MINIMUM_VERSION = "2.20.7";
 /**
  * This version will shortly become the oldest version of CodeQL that the Action will run with.
  */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.21.3";
+const CODEQL_NEXT_MINIMUM_VERSION = "2.22.4";
 
 /**
  * This is the version of GHES that was most recently deprecated.
  */
-const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.17";
+const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.18";
 
 /**
  * This is the deprecation date for the version of GHES that was most recently deprecated.
  */
-const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-09-24";
+const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-10-16";
 
 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
diff --git a/unreleased-change-notes/ghes-3-18-deprecation.md b/unreleased-change-notes/ghes-3-18-deprecation.md
new file mode 100644
index 000000000..0e33d3932
--- /dev/null
+++ b/unreleased-change-notes/ghes-3-18-deprecation.md
@@ -0,0 +1 @@
+- _Upcoming breaking change_: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4266](https://github.com/github/codeql-action/pull/4266)