diff --git a/README.md b/README.md
index 8be919c..95d1d18 100644
--- a/README.md
+++ b/README.md
@@ -27,7 +27,7 @@ with the rest of the Auth0 ecosystem.
 npm install @auth0/auth0-tanstack-start-react
 ```
 
-This SDK relies on the following peer dependencies, which you install in your own app:
+This SDK relies on the following peer dependencies:
 
 | Package | Version |
 | --- | --- |
@@ -35,6 +35,13 @@ This SDK relies on the following peer dependencies, which you install in your ow
 | `react-dom` | `^18.0.0` or `^19.0.0` |
 | `@tanstack/react-router` | `^1.0.0` |
 | `@tanstack/react-start` | `^1.0.0` |
+| `@tanstack/start-server-core` | `^1.169.8` |
+
+You install `react`, `react-dom`, `@tanstack/react-router`, and `@tanstack/react-start` in your own
+app. `@tanstack/start-server-core` usually comes in through `@tanstack/react-start`, so you rarely
+install it directly, but this SDK imports from it directly and needs at least `1.169.8`. If your
+`@tanstack/react-start` resolves an older `@tanstack/start-server-core`, add
+`@tanstack/start-server-core@^1.169.8` to your app.
 
 ## Package structure
 
diff --git a/package.json b/package.json
index 504a757..407c016 100644
--- a/package.json
+++ b/package.json
@@ -65,14 +65,14 @@
   "peerDependencies": {
     "@tanstack/react-router": "^1.0.0",
     "@tanstack/react-start": "^1.0.0",
-    "@tanstack/start-server-core": "^1.0.0",
+    "@tanstack/start-server-core": "^1.169.8",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0"
   },
   "devDependencies": {
     "@tanstack/react-router": "^1.0.0",
     "@tanstack/react-start": "^1.0.0",
-    "@tanstack/start-server-core": "^1.0.0",
+    "@tanstack/start-server-core": "^1.169.8",
     "@testing-library/react": "^16.0.0",
     "@types/node": "^26.3.0",
     "@types/react": "^19.0.0",
diff --git a/src/server/cookie-handler.ts b/src/server/cookie-handler.ts
index 61432dd..3609fd2 100644
--- a/src/server/cookie-handler.ts
+++ b/src/server/cookie-handler.ts
@@ -7,8 +7,12 @@
 // during dependency optimization. The roots also drag in the SSR renderer
 // (renderRouterToString → react-dom/server), which would bloat a client bundle that
 // transitively reaches this module and break hydration. The `/request-response`
-// subpath exposes the same helpers with neither problem — and start-server-core is a
-// direct dependency of @tanstack/react-start, so it is always present.
+// subpath exposes the same helpers with neither problem, but it is only exported by
+// @tanstack/start-server-core 1.169.8 and later (it is absent through 1.169.7). That is
+// the floor pinned in package.json peerDependencies and devDependencies.
+// @tanstack/react-start pins core transitively at an exact version, and older
+// react-start releases pin a core below this floor, so do not assume an already-installed
+// core is new enough.
 import {
   getCookie,
   getCookies,