diff --git a/Dockerfile b/Dockerfile
index a4c31e3a9..c4ca348a5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,7 +18,7 @@
 # NEVER baked into the image — inject them at run time from the host's
 # secret store.
 
-FROM node:24-bookworm-slim@sha256:235600a8101ab264e117b1768e925532262668dc9b581ef1dd7d96ced463b8e7 AS node-base
+FROM node:26-bookworm-slim@sha256:367679cf9792759492a486e4aa4b421764d71a9546a6dae8aab81a99eb797b3e AS node-base
 
 FROM node-base AS deps
 WORKDIR /app
diff --git a/Dockerfile.worker b/Dockerfile.worker
index 52f0644a6..d2fc496af 100644
--- a/Dockerfile.worker
+++ b/Dockerfile.worker
@@ -27,7 +27,7 @@
 # `server-only` marker to the standalone stub at build time (the job
 # run-tsx.mjs previously did at runtime) and keeps npm packages external,
 # so the bundle resolves them from the runner's production node_modules.
-FROM node:24-bookworm-slim@sha256:235600a8101ab264e117b1768e925532262668dc9b581ef1dd7d96ced463b8e7 AS node-base
+FROM node:26-bookworm-slim@sha256:367679cf9792759492a486e4aa4b421764d71a9546a6dae8aab81a99eb797b3e AS node-base
 
 FROM node-base AS build
 WORKDIR /app