diff --git a/docker/Dockerfile b/docker/Dockerfile
index 8c96d503..d5ea2582 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -27,7 +27,7 @@ RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
 # Run on the native build platform to avoid QEMU crashes with esbuild on
 # Apple Silicon.  The output (HTML/CSS/JS) is architecture-agnostic so it
 # is safe to build on arm64 and copy into the amd64 production layer.
-FROM --platform=$BUILDPLATFORM node:22-bookworm@sha256:a25c9934ff6382cd4f08b6bc26c82bf4ea69b1e6f8dabfb2ead457374127c365 AS builder
+FROM --platform=$BUILDPLATFORM node:22-bookworm@sha256:5647be709086c696ff32edaaf1c70cd26d1da6ab2b39c32f3c7b4c4a31957e37 AS builder
 
 RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
 
@@ -189,7 +189,7 @@ RUN curl -fsSL --retry 3 --retry-delay 5 "https://github.com/strukturag/libheif/
 # Stage 3: Platform-specific base images
 # Pin tags to specific major.minor for reproducible builds.
 # ============================================
-FROM node:22-bookworm@sha256:a25c9934ff6382cd4f08b6bc26c82bf4ea69b1e6f8dabfb2ead457374127c365 AS base-linux-arm64
+FROM node:22-bookworm@sha256:5647be709086c696ff32edaaf1c70cd26d1da6ab2b39c32f3c7b4c4a31957e37 AS base-linux-arm64
 # CUDA base must match the remaining GPU AI bundles' torch/onnxruntime wheels
 # (cu126) and the libcublas-12-6 install below. It also sets the NVIDIA_REQUIRE_CUDA
 # driver gate enforced by nvidia-container-toolkit at container start: a 12.6 base
@@ -199,7 +199,7 @@ FROM nvidia/cuda:12.6.3-cudnn-runtime-ubuntu24.04@sha256:8aef630a54bc5c5146ae5ce
 
 # Node.js donor: provides Node binaries for the CUDA amd64 image without
 # relying on NodeSource apt repos or Ubuntu mirrors (which are flaky on CI).
-FROM node:22-bookworm@sha256:a25c9934ff6382cd4f08b6bc26c82bf4ea69b1e6f8dabfb2ead457374127c365 AS node-bins
+FROM node:22-bookworm@sha256:5647be709086c696ff32edaaf1c70cd26d1da6ab2b39c32f3c7b4c4a31957e37 AS node-bins
 
 # ============================================
 # Stage 4: Production runtime
diff --git a/docker/Dockerfile.test b/docker/Dockerfile.test
index b3cdeb15..0a7aaa84 100644
--- a/docker/Dockerfile.test
+++ b/docker/Dockerfile.test
@@ -6,7 +6,7 @@
 # ============================================
 # Stage 1: Build libheif from source
 # ============================================
-FROM node:22-bookworm@sha256:a25c9934ff6382cd4f08b6bc26c82bf4ea69b1e6f8dabfb2ead457374127c365 AS libheif-builder
+FROM node:22-bookworm@sha256:5647be709086c696ff32edaaf1c70cd26d1da6ab2b39c32f3c7b4c4a31957e37 AS libheif-builder
 
 ARG LIBHEIF_VERSION=1.21.2
 
@@ -30,7 +30,7 @@ RUN curl -fsSL "https://github.com/strukturag/libheif/releases/download/v${LIBHE
 # ============================================
 # Stage 2: Test runner
 # ============================================
-FROM node:22-bookworm@sha256:a25c9934ff6382cd4f08b6bc26c82bf4ea69b1e6f8dabfb2ead457374127c365
+FROM node:22-bookworm@sha256:5647be709086c696ff32edaaf1c70cd26d1da6ab2b39c32f3c7b4c4a31957e37
 
 RUN corepack enable && corepack prepare pnpm@9.15.4 --activate