diff --git a/src/agent_env/env/envs/service_db/Dockerfile b/src/agent_env/env/envs/service_db/Dockerfile
index 4ae33d5a..8df29e6e 100644
--- a/src/agent_env/env/envs/service_db/Dockerfile
+++ b/src/agent_env/env/envs/service_db/Dockerfile
@@ -1,4 +1,4 @@
-FROM public.ecr.aws/docker/library/postgres:16-alpine@sha256:721873c34ceb9f8d8fc265984940dc982404c105f19ad51be9fdc5970a6080ea
+FROM public.ecr.aws/docker/library/postgres:18-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873
 
 # ServiceDBEnv - PostgreSQL database for MCP services
 #
diff --git a/src/agent_env/env/envs/service_db/Dockerfile.db-mcp b/src/agent_env/env/envs/service_db/Dockerfile.db-mcp
index 2ee43e67..0dc15d81 100644
--- a/src/agent_env/env/envs/service_db/Dockerfile.db-mcp
+++ b/src/agent_env/env/envs/service_db/Dockerfile.db-mcp
@@ -24,7 +24,7 @@ RUN sed -i 's/mcp = FastMCP("postgres-mcp")/from mcp.server.transport_security i
 
 RUN uv sync --frozen --no-dev
 
-FROM public.ecr.aws/docker/library/python:3.12-slim-bookworm@sha256:6a0e06f5ba0b373d051aabd3fffb9b873f27f9a2a3a14bcbe37dee6f0e3bbc70
+FROM public.ecr.aws/docker/library/python:3.15-slim-bookworm@sha256:0e019bbdfb5d9874cb2389f1c2884b64aa2ac97c99960b5bc521cef978c0617d
 RUN groupadd -r app && useradd -r -g app app
 COPY --from=builder --chown=app:app /app /app
 
diff --git a/src/agent_env/env/envs/service_db/Dockerfile.db-web b/src/agent_env/env/envs/service_db/Dockerfile.db-web
index 3e4540ed..69c5c964 100644
--- a/src/agent_env/env/envs/service_db/Dockerfile.db-web
+++ b/src/agent_env/env/envs/service_db/Dockerfile.db-web
@@ -4,4 +4,4 @@
 # digest) with no anonymous rate limit and no auth required. The digest matches docker.io/sosedoff/pgweb:0.16.2. To bump: pick a
 # new tag from https://github.com/sosedoff/pgweb/pkgs/container/pgweb and update
 # the tag + digest here.
-FROM ghcr.io/sosedoff/pgweb:0.16.2@sha256:8f1ed22e10c9da0912169b98b62ddc54930dc39a5ae07b0f1354d2a93d44c6ed
+FROM ghcr.io/sosedoff/pgweb:0.17.0@sha256:a5256d416e2e8b92d69a4459058e3eca33a9f075d8325491644411d0bc3bd70b
diff --git a/src/agent_env/env/envs/website_browser/Dockerfile b/src/agent_env/env/envs/website_browser/Dockerfile
index 83b24f35..107bba55 100644
--- a/src/agent_env/env/envs/website_browser/Dockerfile
+++ b/src/agent_env/env/envs/website_browser/Dockerfile
@@ -1,4 +1,4 @@
-FROM public.ecr.aws/docker/library/node:22-slim@sha256:813a7480f28fdadac1f7f5c824bcdad435b5bc1322a5968bbbdef8d058f9dff4
+FROM public.ecr.aws/docker/library/node:26-slim@sha256:36793bcbb160a6a16cede1e62b93f84e26b78a972a8a4c0b879c1c12f22761ec
 
 # Chromium runtime dependencies for headless mode, and python3 for the socket probe the gateway's compose
 # health-checks every MCP server with.