diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 186e70784b94..c37e51f28bc2 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -104,6 +104,9 @@ exposed by this class execute synchronously.
 <!-- YAML
 added: v22.5.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/61266
+    description: Enable `defensive` by default.
   - version:
       - v25.1.0
       - v24.12.0
@@ -154,7 +157,7 @@ changes:
   * `defensive` {boolean} If `true`, enables the defensive flag. When the defensive flag is enabled,
     language features that allow ordinary SQL to deliberately corrupt the database file are disabled.
     The defensive flag can also be set using `enableDefensive()`.
-    **Default:** `false`.
+    **Default:** `true`.
 
 Constructs a new `DatabaseSync` instance.
 
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 2641c9d4f1e8..fc4918290e15 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -79,7 +79,7 @@ class DatabaseOpenConfiguration {
   bool return_arrays_ = false;
   bool allow_bare_named_params_ = true;
   bool allow_unknown_named_params_ = false;
-  bool defensive_ = false;
+  bool defensive_ = true;
 };
 
 class DatabaseSync;
diff --git a/test/parallel/test-sqlite-config.js b/test/parallel/test-sqlite-config.js
index eb8455ff45c8..411b9d1cfaea 100644
--- a/test/parallel/test-sqlite-config.js
+++ b/test/parallel/test-sqlite-config.js
@@ -20,9 +20,9 @@ function checkDefensiveMode(db) {
   }
 }
 
-test('by default, defensive mode is off', (t) => {
+test('by default, defensive mode is on', (t) => {
   const db = new DatabaseSync(':memory:');
-  t.assert.strictEqual(checkDefensiveMode(db), false);
+  t.assert.strictEqual(checkDefensiveMode(db), true);
 });
 
 test('when passing { defensive: true } as config, defensive mode is on', (t) => {
@@ -32,13 +32,20 @@ test('when passing { defensive: true } as config, defensive mode is on', (t) =>
   t.assert.strictEqual(checkDefensiveMode(db), true);
 });
 
+test('when passing { defensive: false } as config, defensive mode is off', (t) => {
+  const db = new DatabaseSync(':memory:', {
+    defensive: false
+  });
+  t.assert.strictEqual(checkDefensiveMode(db), false);
+});
+
 test('defensive mode on after calling db.enableDefensive(true)', (t) => {
   const db = new DatabaseSync(':memory:');
   db.enableDefensive(true);
   t.assert.strictEqual(checkDefensiveMode(db), true);
 });
 
-test('defensive mode should be off after calling db.enableDefensive(false)', (t) => {
+test('defensive mode off after calling db.enableDefensive(false)', (t) => {
   const db = new DatabaseSync(':memory:', {
     defensive: true
   });