diff --git a/.docker/Dockerfile.php81 b/.docker/Dockerfile.php81
deleted file mode 100644
index e2d7b94..0000000
--- a/.docker/Dockerfile.php81
+++ /dev/null
@@ -1,84 +0,0 @@
-# UNSUPPORTED: PHP 8.1 has no official security release for CVE-2026-109618/109619.
-# This Dockerfile is kept for historical reference and excluded from GHCR publishing.
-FROM php:8.1-fpm
-
-RUN apt-get update \
-    && apt-get install -y \
-        busybox-static \
-        git \
-        jq \
-        libicu-dev \
-        libzip-dev \
-        locales \
-        poppler-utils \
-        procps \
-        unzip \
-        # cron
-    && mkdir -p /var/spool/cron/crontabs \
-    && echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data \
-    && sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen \
-    && locale-gen \
-    && rm -rf /var/lib/apt/lists/*
-
-ENV LANG=en_US.UTF-8
-ENV LANGUAGE=en_US:en
-ENV LC_ALL=en_US.UTF-8
-
-# Install PHP extensions
-ADD https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/
-RUN chmod uga+x /usr/local/bin/install-php-extensions && sync \
-    && install-php-extensions \
-    apcu \
-    bcmath \
-    bz2 \
-    exif \
-    gd \
-    gettext \
-    gmp \
-    imagick \
-    intl \
-    memcache \
-    memcached \
-    mysqli \
-    opcache \
-    pcntl \
-    pdo \
-    pdo_mysql \
-    pdo_pgsql \
-    pdo_sqlite \
-    pgsql \
-    redis \
-    sockets \
-    sodium \
-    sysvsem \
-    xdebug \
-    zip \
-    @composer \
-    && rm /usr/local/bin/install-php-extensions \
-    # pevent errors when try to create files at /var/www with user www-data
-    && chown -R www-data /var/www
-
-# Install NVM
-RUN export NVM_DIR="/usr/local/nvm" \
-    && mkdir -p "$NVM_DIR" \
-    && curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/master/install.sh | bash \
-    && . "$NVM_DIR/nvm.sh" \
-    && nvm install 20 \
-    && nvm alias default 20 \
-    && NODE_VERSION="$(nvm version default)" \
-    && ln -s "$NVM_DIR/versions/node/$NODE_VERSION/bin/node" /usr/local/bin/node \
-    && ln -s "$NVM_DIR/versions/node/$NODE_VERSION/bin/npm" /usr/local/bin/npm \
-    && ln -s "$NVM_DIR/versions/node/$NODE_VERSION/bin/npx" /usr/local/bin/npx \
-    && echo 'export NVM_DIR="/usr/local/nvm"' > /etc/profile.d/nvm.sh \
-    && echo '[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"' >> /etc/profile.d/nvm.sh
-
-COPY config/php/* /usr/local/etc/php/conf.d/
-COPY scripts/* /var/www/scripts/
-COPY bin/* /usr/local/bin/
-
-VOLUME /var/www/html
-
-WORKDIR /var/www/html
-
-ENTRYPOINT [ "bash", "/var/www/scripts/nextcloud-entrypoint.sh" ]
-CMD ["php-fpm"]
diff --git a/.docker/Dockerfile.php82 b/.docker/Dockerfile.php82
index a9223cc..951d6d1 100644
--- a/.docker/Dockerfile.php82
+++ b/.docker/Dockerfile.php82
@@ -1,5 +1,8 @@
 FROM php:8.2.35-fpm@sha256:a58479410c94b3f0f7dfacc27fba8befc122290743fd0eb8c88a99ff2a0b1ba1
 
+# Fail closed if a dependency update changes the PHP minor runtime.
+RUN test "$(php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;')" = "8.2"
+
 
 
 RUN apt-get update \
diff --git a/.docker/Dockerfile.php83 b/.docker/Dockerfile.php83
index c6e8791..dd07360 100644
--- a/.docker/Dockerfile.php83
+++ b/.docker/Dockerfile.php83
@@ -1,5 +1,8 @@
 FROM php:8.3.36-fpm@sha256:d0dea3f5d95314eac94a732469f4cf0ee658a22c2ce3f2612272b9d5b42d1a72
 
+# Fail closed if a dependency update changes the PHP minor runtime.
+RUN test "$(php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;')" = "8.3"
+
 
 
 RUN apt-get update \
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a1174c8..d48f9ba 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,6 +9,12 @@ updates:
     directory: "/.docker/"
     schedule:
       interval: "daily"
+    # Each Dockerfile targets a fixed PHP minor version; update patches only.
+    ignore:
+      - dependency-name: "php"
+        update-types:
+          - "version-update:semver-minor"
+          - "version-update:semver-major"
 
   - package-ecosystem: "docker-compose"
     directories:
diff --git a/.github/workflows/docker-php.yml b/.github/workflows/docker-php.yml
index 6d2e1f6..e68e5e1 100644
--- a/.github/workflows/docker-php.yml
+++ b/.github/workflows/docker-php.yml
@@ -58,6 +58,19 @@ jobs:
           NAME="${{ matrix.container }}"
           DOCKERFILE=$([[ -f ".docker/$NAME/Dockerfile" ]] && echo ".docker/$NAME/Dockerfile" || echo ".docker/Dockerfile.$NAME")
           echo "DOCKERFILE=$DOCKERFILE" >> $GITHUB_OUTPUT
+      - name: Verify Dockerfile PHP version
+        env:
+          DOCKERFILE: ${{ steps.dockerfile.outputs.DOCKERFILE }}
+          PHP_VERSION: ${{ matrix.version }}
+        shell: bash
+        run: |
+          major="${PHP_VERSION%%.*}"
+          minor="${PHP_VERSION#*.}"
+          from="$(grep -m 1 -E '^FROM[[:space:]]+' "$DOCKERFILE")"
+          if [[ ! "$from" =~ ^FROM[[:space:]]+php:${major}[.]${minor}[.][0-9]+-fpm@sha256:[0-9a-f]{64}$ ]]; then
+            echo "::error file=$DOCKERFILE::Expected pinned PHP $PHP_VERSION patch image and sha256 digest; found: $from"
+            exit 1
+          fi
       - name: Build container image
         uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
diff --git a/docs/advanced-setup.md b/docs/advanced-setup.md
index 410ff6f..2a7aac2 100644
--- a/docs/advanced-setup.md
+++ b/docs/advanced-setup.md
@@ -12,6 +12,16 @@ VERSION_NEXTCLOUD=stable33 docker compose up
 
 By default, `VERSION_NEXTCLOUD` uses `master`. To use another Nextcloud version, set it to the corresponding branch from the [Nextcloud server repository](https://github.com/nextcloud/server).
 
+### PHP versions
+
+PHP 8.3 (`PHP_VERSION=83`) is the default, and PHP 8.2 (`PHP_VERSION=82`)
+remains available for compatibility. PHP 8.1 is no longer supported or built;
+its Dockerfile is retained in Git history only.
+
+Base images are pinned to a PHP patch version and OCI digest. Dependabot can
+update patches and digests within each supported PHP minor series. A new PHP
+minor version requires an explicit Dockerfile and publishing-matrix change.
+
 Xdebug can be configured with its native `XDEBUG_MODE` variable:
 
 ```bash