diff --git a/docker/Dockerfile b/docker/Dockerfile
index ca3f0cfa..baa05020 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -27,7 +27,7 @@ RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
 # Run on the native build platform to avoid QEMU crashes with esbuild on
 # Apple Silicon.  The output (HTML/CSS/JS) is architecture-agnostic so it
 # is safe to build on arm64 and copy into the amd64 production layer.
-FROM --platform=$BUILDPLATFORM node:22-bookworm@sha256:e0d149b4727ac0c20d9774e801e423d7a946a0bffced886f42cfe9cd3c67820a AS builder
+FROM --platform=$BUILDPLATFORM node:22-bookworm@sha256:c601a46abb4d2ab80a9dc3da208d50d1122642d53f17a101926ace71e5a9bf1c AS builder
 
 RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
 
@@ -187,7 +187,7 @@ RUN curl -fsSL --retry 3 --retry-delay 5 "https://github.com/strukturag/libheif/
 # Stage 3: Platform-specific base images
 # Pin tags to specific major.minor for reproducible builds.
 # ============================================
-FROM node:22-bookworm@sha256:e0d149b4727ac0c20d9774e801e423d7a946a0bffced886f42cfe9cd3c67820a AS base-linux-arm64
+FROM node:22-bookworm@sha256:c601a46abb4d2ab80a9dc3da208d50d1122642d53f17a101926ace71e5a9bf1c AS base-linux-arm64
 # CUDA base must match the AI bundles' wheels (torch/paddle/onnxruntime-gpu are all
 # cu126) and the libcublas-12-6 install below. It also sets the NVIDIA_REQUIRE_CUDA
 # driver gate enforced by nvidia-container-toolkit at container start: a 12.6 base
@@ -197,7 +197,7 @@ FROM nvidia/cuda:12.6.3-cudnn-runtime-ubuntu24.04@sha256:8aef630a54bc5c5146ae5ce
 
 # Node.js donor: provides Node binaries for the CUDA amd64 image without
 # relying on NodeSource apt repos or Ubuntu mirrors (which are flaky on CI).
-FROM node:22-bookworm@sha256:e0d149b4727ac0c20d9774e801e423d7a946a0bffced886f42cfe9cd3c67820a AS node-bins
+FROM node:22-bookworm@sha256:c601a46abb4d2ab80a9dc3da208d50d1122642d53f17a101926ace71e5a9bf1c AS node-bins
 
 # ============================================
 # Stage 4: Production runtime
diff --git a/docker/Dockerfile.test b/docker/Dockerfile.test
index f9bbc09f..75d5d76d 100644
--- a/docker/Dockerfile.test
+++ b/docker/Dockerfile.test
@@ -6,7 +6,7 @@
 # ============================================
 # Stage 1: Build libheif from source
 # ============================================
-FROM node:22-bookworm@sha256:e0d149b4727ac0c20d9774e801e423d7a946a0bffced886f42cfe9cd3c67820a AS libheif-builder
+FROM node:22-bookworm@sha256:c601a46abb4d2ab80a9dc3da208d50d1122642d53f17a101926ace71e5a9bf1c AS libheif-builder
 
 ARG LIBHEIF_VERSION=1.21.2
 
@@ -30,7 +30,7 @@ RUN curl -fsSL "https://github.com/strukturag/libheif/releases/download/v${LIBHE
 # ============================================
 # Stage 2: Test runner
 # ============================================
-FROM node:22-bookworm@sha256:e0d149b4727ac0c20d9774e801e423d7a946a0bffced886f42cfe9cd3c67820a
+FROM node:22-bookworm@sha256:c601a46abb4d2ab80a9dc3da208d50d1122642d53f17a101926ace71e5a9bf1c
 
 RUN corepack enable && corepack prepare pnpm@9.15.4 --activate