diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 64569c63..81db6689 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -367,8 +367,13 @@ jobs:
           PY
           test -s /tmp/prebuilt-root/snapotter/apps/web/dist/index.html
           test -s /tmp/prebuilt-root/snapotter/apps/api/src/index.ts
-          test -x /tmp/prebuilt-root/snapotter/node_modules/.bin/tsx
-          /tmp/prebuilt-root/snapotter/node_modules/.bin/tsx --version
+          # tsx is a prod dependency of apps/api, so pnpm's workspace layout puts
+          # its bin under apps/api/node_modules/.bin, not the workspace root. This
+          # is exactly where the Docker CMD runs it from (WORKDIR apps/api,
+          # ./node_modules/.bin/tsx). The root path never existed; this assertion
+          # was added in #649 and this is its first real release run.
+          test -x /tmp/prebuilt-root/snapotter/apps/api/node_modules/.bin/tsx
+          ( cd /tmp/prebuilt-root/snapotter/apps/api && ./node_modules/.bin/tsx --version )
           echo "archive_name=${archive_name}" >> "$GITHUB_ENV"
 
       - name: Install pinned Syft 1.42.3 from verified release bytes
diff --git a/docker/go-tools/caire/go.mod b/docker/go-tools/caire/go.mod
index ce13b795..fb2675ac 100644
--- a/docker/go-tools/caire/go.mod
+++ b/docker/go-tools/caire/go.mod
@@ -6,3 +6,5 @@ require (
 	github.com/esimov/caire v1.5.0
 	golang.org/x/image v0.43.0
 )
+
+require golang.org/x/text v0.39.0 // indirect
diff --git a/docker/go-tools/caire/go.sum b/docker/go-tools/caire/go.sum
index 06c58816..7e99f05d 100644
--- a/docker/go-tools/caire/go.sum
+++ b/docker/go-tools/caire/go.sum
@@ -22,11 +22,19 @@ golang.org/x/exp/shiny v0.0.0-20240707233637-46b078467d37 h1:SOSg7+sueresE4IbmmG
 golang.org/x/exp/shiny v0.0.0-20240707233637-46b078467d37/go.mod h1:3F+MieQB7dRYLTmnncoFbb1crS5lfQoTfDgQy6K4N0o=
 golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
 golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
 golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20220722155259-a9ba230a4035 h1:Q5284mrmYTpACcm+eAKjKJH48BBwSyfJqmmGDTtT8Vc=
 golang.org/x/term v0.0.0-20220722155259-a9ba230a4035/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
 golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
+golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/docker/go-tools/pdfcpu/go.mod b/docker/go-tools/pdfcpu/go.mod
index efd5d23b..6ed38818 100644
--- a/docker/go-tools/pdfcpu/go.mod
+++ b/docker/go-tools/pdfcpu/go.mod
@@ -6,3 +6,5 @@ require (
 	github.com/pdfcpu/pdfcpu v0.13.0
 	golang.org/x/image v0.43.0
 )
+
+require golang.org/x/text v0.39.0 // indirect
diff --git a/docker/go-tools/pdfcpu/go.sum b/docker/go-tools/pdfcpu/go.sum
index c0431b50..27c673bb 100644
--- a/docker/go-tools/pdfcpu/go.sum
+++ b/docker/go-tools/pdfcpu/go.sum
@@ -22,7 +22,15 @@ golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
 golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
 golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
 golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
+golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
diff --git a/tests/unit/infra/release-supply-chain.test.ts b/tests/unit/infra/release-supply-chain.test.ts
index 6803eee0..6aedaaf6 100644
--- a/tests/unit/infra/release-supply-chain.test.ts
+++ b/tests/unit/infra/release-supply-chain.test.ts
@@ -119,7 +119,11 @@ describe("release supply-chain closure", () => {
     expect(archiveSecurity).toContain("Verify immutable release tag binding");
     expect(archiveSecurity).toContain("sha256sum --check --strict");
     expect(archiveSecurity).toContain('filter="data"');
-    expect(archiveSecurity).toContain("node_modules/.bin/tsx --version");
+    // tsx is asserted at apps/api/node_modules/.bin, where pnpm's workspace layout
+    // actually places a workspace-package dependency and where the Docker CMD runs
+    // it. The root path never existed and failed the first real release run.
+    expect(archiveSecurity).toContain("apps/api/node_modules/.bin/tsx");
+    expect(archiveSecurity).not.toContain("snapotter/node_modules/.bin/tsx");
     expect(archiveSecurity).toContain(
       "cyclonedx-json=snapotter-v${VERSION}-archive-linux-${ARCH}-sbom.cdx.json",
     );
diff --git a/tests/unit/security/dockerfile-build-args.test.ts b/tests/unit/security/dockerfile-build-args.test.ts
index 692cbba4..334e6a0c 100644
--- a/tests/unit/security/dockerfile-build-args.test.ts
+++ b/tests/unit/security/dockerfile-build-args.test.ts
@@ -83,8 +83,12 @@ describe("Dockerfile build args", () => {
 
       expect(module).toContain(contract.application);
       expect(module).toContain("golang.org/x/image v0.43.0");
+      // x/text is pinned to the patched line the same way x/image is: 0.38.0
+      // carried CVE-2026-56852 (fixed in 0.39.0) and is linked into both binaries.
+      expect(module).toContain("golang.org/x/text v0.39.0");
       expect(checksums).toContain(`${contract.application} h1:`);
       expect(checksums).toContain("golang.org/x/image v0.43.0 h1:");
+      expect(checksums).toContain("golang.org/x/text v0.39.0 h1:");
       expect(stage).toContain(
         `COPY docker/go-tools/${contract.directory}/go.mod docker/go-tools/${contract.directory}/go.sum ./`,
       );