diff --git a/Dockerfile.test b/Dockerfile.test
index 15b71567aa8..1a9add572f6 100644
--- a/Dockerfile.test
+++ b/Dockerfile.test
@@ -10,7 +10,7 @@
 #   docker run --rm -v ./packages/producer/tests:/app/packages/producer/tests hyperframes-producer:test
 #   docker run --rm -v ./packages/producer/tests:/app/packages/producer/tests hyperframes-producer:test --update
 
-FROM node:22.23.4-bookworm-slim
+FROM node:22.23.5-bookworm-slim
 
 # ── System dependencies (identical to production) ────────────────────────────
 RUN apt-get update && apt-get install -y --no-install-recommends \
diff --git a/packages/aws-lambda/image/Dockerfile b/packages/aws-lambda/image/Dockerfile
index 007afd6ca0e..5af722fde46 100644
--- a/packages/aws-lambda/image/Dockerfile
+++ b/packages/aws-lambda/image/Dockerfile
@@ -1,7 +1,7 @@
 # The arm64 Lambda video function's native ffmpeg, built on the Lambda Node 22 base it runs on:
 #   docker buildx build --platform linux/arm64 --target artifact --output type=local,dest=out packages/aws-lambda/image
 # The artifact stage depends on the check stage, so no tarball comes out of a build whose codecs fail.
-ARG BASE=public.ecr.aws/lambda/nodejs:22@sha256:d138eff445f6ea04c51091d8e6cbb064d5663e850cddfa62396061586f98b126
+ARG BASE=public.ecr.aws/lambda/nodejs:22@sha256:f571ad6becf9000980068fab79b9aac30c369fdd69817c0803f33ecaa9206834
 
 FROM ${BASE} AS build
 ENV SOURCE_DATE_EPOCH=1722643200
diff --git a/packages/cli/src/docker/Dockerfile.render b/packages/cli/src/docker/Dockerfile.render
index 9667dc6f1f8..4da4f41d84a 100644
--- a/packages/cli/src/docker/Dockerfile.render
+++ b/packages/cli/src/docker/Dockerfile.render
@@ -1,4 +1,4 @@
-FROM node:22.23.4-bookworm-slim
+FROM node:22.23.5-bookworm-slim
 
 ARG HYPERFRAMES_VERSION=latest
 # Set automatically by `docker build --platform` (BuildKit); selects the
diff --git a/packages/gcp-cloud-run/Dockerfile b/packages/gcp-cloud-run/Dockerfile
index 044bc3633fa..20a93059fd6 100644
--- a/packages/gcp-cloud-run/Dockerfile
+++ b/packages/gcp-cloud-run/Dockerfile
@@ -21,7 +21,7 @@
 # Unlike the AWS Lambda adapter there is no ZIP-size ceiling and no runtime
 # Chrome decompression step — the binary lives in the image at a fixed path.
 
-FROM node:22.23.4-bookworm-slim@sha256:5ec23b7c622b00547753bc6ffd78085dd868a68aeb41c8e0a1418f033e13d96d AS beginframe-contract
+FROM node:22.23.5-bookworm-slim@sha256:e9f565d32859f0cbfb52125eafe8be39390f24dac302dc3cdf566e8ba3ab21ee AS beginframe-contract
 
 # ── System dependencies (identical set to the producer's render image) ───────
 RUN apt-get update && apt-get install -y --no-install-recommends \