diff --git a/Cargo.lock b/Cargo.lock
index ebc028bb1..96408fbff 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -376,7 +376,7 @@ dependencies = [
  "criterion",
  "ed25519-dalek",
  "fail",
- "fancy-regex 0.19.2",
+ "fancy-regex 0.20.0",
  "flate2",
  "foldhash",
  "futures-core",
@@ -1818,9 +1818,9 @@ dependencies = [
 
 [[package]]
 name = "fancy-regex"
-version = "0.19.2"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d301f5bf187b3c295fce6468d3875037a0bccc5f6b151c63cac2f85babf21912"
+checksum = "20ed7f62ce0ae0da1a8b93c3c7104ab7e0760a74491e097c701fff966e945390"
 dependencies = [
  "bit-set 0.8.0",
  "regex-automata",
diff --git a/Cargo.toml b/Cargo.toml
index 5f7915e28..26d3637fa 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -62,7 +62,7 @@ rustls = { version = "0.23", default-features = false, features = ["std", "tls12
 # Regex
 regex = "1"
 regex-automata = { version = "0.4", default-features = false, features = ["std", "syntax", "hybrid", "unicode", "perf"] }
-fancy-regex = "0.19"
+fancy-regex = "0.20"
 
 # Date/Time
 # Important decision: `default-features = false` drops chrono's `wasmbind`,
diff --git a/crates/bashkit/fuzz/Cargo.lock b/crates/bashkit/fuzz/Cargo.lock
index 185cf1060..a1c36f7be 100644
--- a/crates/bashkit/fuzz/Cargo.lock
+++ b/crates/bashkit/fuzz/Cargo.lock
@@ -718,14 +718,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "fancy-regex"
-version = "0.19.2"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d301f5bf187b3c295fce6468d3875037a0bccc5f6b151c63cac2f85babf21912"
+checksum = "20ed7f62ce0ae0da1a8b93c3c7104ab7e0760a74491e097c701fff966e945390"
 dependencies = [
  "bit-set",
  "regex-automata",
@@ -1564,7 +1564,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2271,7 +2271,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/crates/bashkit/src/builtins/search_common.rs b/crates/bashkit/src/builtins/search_common.rs
index f804fed26..b1b690db6 100644
--- a/crates/bashkit/src/builtins/search_common.rs
+++ b/crates/bashkit/src/builtins/search_common.rs
@@ -13,7 +13,14 @@ use crate::builtins::limits::RUNTIME_REGEX_CACHE_ENTRIES;
 /// Default compiled-regex size limit (1 MB).
 pub(crate) const REGEX_SIZE_LIMIT: usize = 1_000_000;
 
-/// Default DFA size limit (1 MB).
+/// Default DFA budget (1 MB).
+///
+/// Two engines read this constant and mean different things by it. For the
+/// `regex` crate it is `dfa_size_limit`, a cap on compiled DFA size. For
+/// fancy-regex it is `delegate_dfa_size_limit`, which since 0.20.0 sets the
+/// *lazy-DFA cache capacity* rather than a compiled-DFA size cap; 0.20.0 also
+/// enables `delegate_dfa_skip_cache_capacity_check` by default, so a value too
+/// small for a pattern degrades instead of failing to compile.
 pub(crate) const REGEX_DFA_SIZE_LIMIT: usize = 1_000_000;
 
 /// Backtracking step cap for the fancy-regex (PCRE / `grep -P`) engine.
diff --git a/examples/hyperlight/Cargo.lock b/examples/hyperlight/Cargo.lock
index e3c53e4bc..a361e91be 100644
--- a/examples/hyperlight/Cargo.lock
+++ b/examples/hyperlight/Cargo.lock
@@ -398,9 +398,9 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "fancy-regex"
-version = "0.19.2"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d301f5bf187b3c295fce6468d3875037a0bccc5f6b151c63cac2f85babf21912"
+checksum = "20ed7f62ce0ae0da1a8b93c3c7104ab7e0760a74491e097c701fff966e945390"
 dependencies = [
  "bit-set",
  "regex-automata",
diff --git a/supply-chain/config.toml b/supply-chain/config.toml
index 92f834f8c..42d7d3f15 100644
--- a/supply-chain/config.toml
+++ b/supply-chain/config.toml
@@ -597,7 +597,7 @@ version = "0.17.0"
 criteria = "safe-to-deploy"
 
 [[exemptions.fancy-regex]]
-version = "0.19.2"
+version = "0.20.0"
 criteria = "safe-to-deploy"
 
 [[exemptions.fastbloom]]