diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6acbd3c6b..c0246e33b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,6 +32,10 @@ jobs:
             -t infrascielo/metodologia:latest \
             .
 
+      - name: Verify patched PHP version
+        run: |
+          test "$(docker run --rm --entrypoint php infrascielo/metodologia:${VERSION} -r 'echo PHP_VERSION;')" = "8.5.12"
+
       # 🔐 Scan único (policy)
       - name: Trivy Image Scan
         uses: aquasecurity/trivy-action@v0.35.0
@@ -78,11 +82,6 @@ jobs:
           docker push infrascielo/metodologia:${VERSION}
           docker push infrascielo/metodologia:latest
 
-      - name: Push image
-        run: |
-          docker push infrascielo/metodologia:${VERSION}
-          docker push infrascielo/metodologia:latest
-
       - name: Get image digest
         run: |
           DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' infrascielo/metodologia:${VERSION})
diff --git a/README.md b/README.md
index 617a2fb67..14324f636 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,25 @@
 # Web
 SciELO Web
 
+## Versão do PHP
+
+A imagem Rocky Linux compila e fixa o PHP **8.5.12**, versão que corrige as
+vulnerabilidades críticas CVE-2026-109618 e CVE-2026-109619. O código-fonte é
+baixado de `php.net`, validado pelo SHA-256 oficial e conferido novamente no
+build, no início do container e no pipeline de release. O container se recusa a
+iniciar se a versão instalada não for exatamente a esperada.
+
+Para reconstruir sem reutilizar uma imagem anterior e confirmar a versão:
+
+```sh
+docker compose build --no-cache scielo-web
+docker compose run --rm --entrypoint php scielo-web -v
+docker compose up -d --force-recreate
+```
+
+O primeiro comando deve produzir uma imagem com `PHP 8.5.12`. Não reutilize a
+imagem `infrascielo/metodologia:v7.1-qa`, pois ela não oferece essa garantia.
+
 
 A partir da versão **5.45.2**, copiar os arquivos `gizmo.*`, disponíveis em `bases_modelo/gizmo` para o diretório `bases/gizmo` da aplicação implantada.
 Caso a página do site não carregue conforme esperado, execute também:
diff --git a/docker-compose.yml b/docker-compose.yml
index baacdadb2..0f1d61db3 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,7 +1,13 @@
 services:
   scielo-web:
     platform: linux/amd64
-    image: infrascielo/metodologia:v7.1-qa
+    build:
+      context: .
+      dockerfile: docker/rocky9/Dockerfile
+      args:
+        PHP_VERSION: 8.5.12
+        PHP_SHA256: 08bc2eba2a588654ade1357174aa646b761556c862dda0678345ee29ed481209
+    image: infrascielo/metodologia:php-8.5.12-local
     container_name: scielo-web-rocky9
     ports:
       - "80:80"
diff --git a/docker/rocky9/Dockerfile b/docker/rocky9/Dockerfile
index 1d6ff2f37..461e17c3e 100644
--- a/docker/rocky9/Dockerfile
+++ b/docker/rocky9/Dockerfile
@@ -1,43 +1,132 @@
 FROM rockylinux:9
 
+# Keep the patched PHP release and its upstream checksum together. Builds fail
+# closed if the downloaded source does not match this exact PHP release.
+ARG PHP_VERSION=8.5.12
+ARG PHP_SHA256=08bc2eba2a588654ade1357174aa646b761556c862dda0678345ee29ed481209
+
 RUN dnf -y --refresh upgrade \
-    && dnf -y install --setopt=install_weak_deps=False \
-    https://rpms.remirepo.net/enterprise/remi-release-9.rpm \
-    dnf-plugins-core \
-    && dnf -y module reset php \
-    && dnf -y module enable php:remi-8.5 \
-    && dnf -y install --setopt=install_weak_deps=False \
+    && dnf -y install --setopt=install_weak_deps=False dnf-plugins-core \
+    && dnf config-manager --set-enabled crb \
+    && dnf -y install --allowerasing --setopt=install_weak_deps=False \
     httpd \
-    php \
-    php-fpm \
-    php-cli \
-    php-common \
-    php-mysqlnd \
-    php-xml \
-    php-mbstring \
-    php-gd \
-    php-opcache \
-    php-process \
+    ca-certificates \
+    curl \
+    libcurl \
+    freetype \
+    gettext \
+    libjpeg-turbo \
+    libpng \
+    libxml2 \
+    libxslt \
+    libzip \
+    oniguruma \
+    openssl-libs \
+    readline \
+    sqlite-libs \
+    zlib \
+    autoconf \
+    bison \
+    gcc \
+    gcc-c++ \
+    make \
+    pkgconf-pkg-config \
+    tar \
+    xz \
+    libcurl-devel \
+    freetype-devel \
+    gettext-devel \
+    libjpeg-turbo-devel \
+    libpng-devel \
+    libxml2-devel \
+    libxslt-devel \
+    libzip-devel \
+    oniguruma-devel \
+    openssl-devel \
+    readline-devel \
+    sqlite-devel \
+    zlib-devel \
+    && curl --fail --show-error --silent --location \
+        --output /tmp/php.tar.xz \
+        "https://www.php.net/distributions/php-${PHP_VERSION}.tar.xz" \
+    && echo "${PHP_SHA256}  /tmp/php.tar.xz" | sha256sum --check --strict \
+    && mkdir -p /usr/src/php \
+    && tar -xJf /tmp/php.tar.xz --strip-components=1 -C /usr/src/php \
+    && cd /usr/src/php \
+    && ./configure \
+        --prefix=/usr \
+        --sysconfdir=/etc \
+        --localstatedir=/var \
+        --with-config-file-path=/etc \
+        --with-config-file-scan-dir=/etc/php.d \
+        --disable-cgi \
+        --enable-fpm \
+        --with-fpm-user=apache \
+        --with-fpm-group=apache \
+        --enable-gd \
+        --with-freetype \
+        --with-jpeg \
+        --enable-mbstring \
+        --enable-mysqlnd \
+        --with-mysqli=mysqlnd \
+        --with-pdo-mysql=mysqlnd \
+        --enable-pcntl \
+        --enable-posix \
+        --enable-soap \
+        --enable-sockets \
+        --enable-sysvmsg \
+        --enable-sysvsem \
+        --enable-sysvshm \
+        --with-curl \
+        --with-gettext \
+        --with-libdir=lib64 \
+        --with-openssl \
+        --with-readline \
+        --with-xsl \
+        --with-zip \
+        --with-zlib \
+    && make -j"$(nproc)" \
+    && make install \
+    && install -d /etc/php.d /etc/php-fpm.d /run/php-fpm \
+    && install -m 0644 php.ini-production /etc/php.ini \
+    && cp /etc/php-fpm.conf.default /etc/php-fpm.conf \
+    && cp /etc/php-fpm.d/www.conf.default /etc/php-fpm.d/www.conf \
+    && sed -ri \
+        -e 's#^user = .*$#user = apache#' \
+        -e 's#^group = .*$#group = apache#' \
+        -e 's#^listen = .*$#listen = /run/php-fpm/www.sock#' \
+        -e 's#^;listen.owner = .*$#listen.owner = apache#' \
+        -e 's#^;listen.group = .*$#listen.group = apache#' \
+        -e 's#^;listen.mode = .*$#listen.mode = 0660#' \
+        /etc/php-fpm.d/www.conf \
+    && test "$(php -r 'echo PHP_VERSION;')" = "${PHP_VERSION}" \
+    && php -r 'exit(version_compare(PHP_VERSION, "8.5.12", ">=") ? 0 : 1);' \
+    && php -r '$required = ["curl", "dom", "gd", "libxml", "mbstring", "mysqli", "pdo_mysql", "simplexml", "xsl", "Zend OPcache"]; foreach ($required as $extension) { if (!extension_loaded($extension)) { fwrite(STDERR, "Missing PHP extension: {$extension}\n"); exit(1); } }' \
+    && printf '%s\n' "${PHP_VERSION}" > /etc/scielo-php-version \
+    && dnf -y remove \
+        autoconf bison gcc gcc-c++ make pkgconf-pkg-config \
+        libcurl-devel freetype-devel gettext-devel libjpeg-turbo-devel \
+        libpng-devel libxml2-devel libxslt-devel libzip-devel \
+        oniguruma-devel openssl-devel readline-devel sqlite-devel zlib-devel \
     && dnf -y --refresh upgrade \
     && (rpm -q vim-minimal && dnf -y remove vim-minimal || true) \
     && dnf clean all \
-    && rm -rf /var/cache/dnf
+    && rm -rf /var/cache/dnf /tmp/php.tar.xz /usr/src/php
 
 COPY docker/rocky9/httpd-scielo.conf /etc/httpd/conf.d/scielo.conf
 COPY docker/rocky9/php-scielo.ini /etc/php.d/99-scielo.ini
 COPY docker/rocky9/entrypoint.sh /usr/local/bin/entrypoint-scielo.sh
 COPY docker/rocky9/scielo-instance-check.sh /usr/local/bin/scielo-instance-check.sh
 
-RUN sed -ri 's#^(user|group) = .*$#\1 = apache#' /etc/php-fpm.d/www.conf && \
-    sed -ri 's#^listen\.acl_users = .*$#listen.acl_users = apache#' /etc/php-fpm.d/www.conf
-
 # Reuse the default /cgi-bin/ ScriptAlias, but point it to the project cgi-bin.
-RUN sed -ri 's#^[[:space:]]*ScriptAlias /cgi-bin/ ".*"#ScriptAlias /cgi-bin/ "/var/www/html/cgi-bin/"#' /etc/httpd/conf/httpd.conf && \
-    sed -ri 's#<Directory "/var/www/cgi-bin">#<Directory "/var/www/html/cgi-bin">#' /etc/httpd/conf/httpd.conf
+RUN sed -ri 's#^[[:space:]]*ScriptAlias /cgi-bin/ ".*"#ScriptAlias /cgi-bin/ "/var/www/html/cgi-bin/"#' /etc/httpd/conf/httpd.conf \
+    && sed -ri 's#<Directory "/var/www/cgi-bin">#<Directory "/var/www/html/cgi-bin">#' /etc/httpd/conf/httpd.conf \
+    && mkdir -p /var/www/html \
+    && chown -R apache:apache /var/www/html \
+    && chmod +x /usr/local/bin/entrypoint-scielo.sh /usr/local/bin/scielo-instance-check.sh
 
-RUN mkdir -p /var/www/html && \
-    chown -R apache:apache /var/www/html && \
-    chmod +x /usr/local/bin/entrypoint-scielo.sh /usr/local/bin/scielo-instance-check.sh
+LABEL org.opencontainers.image.version="${PHP_VERSION}" \
+      org.opencontainers.image.description="SciELO Web on patched PHP 8.5.12"
 
 EXPOSE 80
 
diff --git a/docker/rocky9/entrypoint.sh b/docker/rocky9/entrypoint.sh
index e26394178..003dc7701 100644
--- a/docker/rocky9/entrypoint.sh
+++ b/docker/rocky9/entrypoint.sh
@@ -1,6 +1,13 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+EXPECTED_PHP_VERSION="$(cat /etc/scielo-php-version)"
+INSTALLED_PHP_VERSION="$(php -r 'echo PHP_VERSION;')"
+if [[ "$INSTALLED_PHP_VERSION" != "$EXPECTED_PHP_VERSION" ]]; then
+  echo "Refusing to start: expected PHP $EXPECTED_PHP_VERSION, found $INSTALLED_PHP_VERSION" >&2
+  exit 1
+fi
+
 mkdir -p /run/php-fpm
 chown apache:apache /run/php-fpm
 
diff --git a/docker/rocky9/httpd-scielo.conf b/docker/rocky9/httpd-scielo.conf
index 234ba898c..3b74f0b5c 100644
--- a/docker/rocky9/httpd-scielo.conf
+++ b/docker/rocky9/httpd-scielo.conf
@@ -6,6 +6,10 @@ TraceEnable Off
 DocumentRoot "/var/www/html/htdocs"
 DirectoryIndex scielo.php index.php index.html
 
+<FilesMatch "\.php$">
+    SetHandler "proxy:unix:/run/php-fpm/www.sock|fcgi://localhost/"
+</FilesMatch>
+
 Alias /pdf/ "/var/www/html/bases/pdf/"
 
 <Directory "/var/www/html/htdocs">
diff --git a/docker/rocky9/php-scielo.ini b/docker/rocky9/php-scielo.ini
index d9b396178..e967e45eb 100644
--- a/docker/rocky9/php-scielo.ini
+++ b/docker/rocky9/php-scielo.ini
@@ -2,6 +2,7 @@ short_open_tag = On
 display_errors = Off
 display_startup_errors = Off
 expose_php = Off
+opcache.enable = On
 log_errors = On
 error_reporting = E_ALL & ~E_DEPRECATED & ~E_NOTICE
 date.timezone = America/Sao_Paulo