diff --git a/Dockerfile b/Dockerfile
index b32c8f1..2c71750 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,7 @@
-FROM node:slim
+# Node 24.22.1 includes the 2026-10-21 security release
+# (CVE-2026-111497 Brotli RCE, TLS hostname bypasses).
+# https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
+FROM node:24.22.1-slim
 
 ENV NODE_ENV=production