diff --git a/.github/workflows/osv-scanner-scheduled.yml b/.github/workflows/osv-scanner-scheduled.yml
index eac37b0..0ed00e3 100644
--- a/.github/workflows/osv-scanner-scheduled.yml
+++ b/.github/workflows/osv-scanner-scheduled.yml
@@ -26,4 +26,4 @@ jobs:
   scan-scheduled:
     name: Scan dependencies
     if: github.event_name == 'push' || github.event_name == 'schedule'
-    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.5.0
diff --git a/Dockerfile b/Dockerfile
index 2e05c93..9add675 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -22,11 +22,14 @@ ENV PATH="/opt/venv/bin:$PATH"
 # Upgrade packaging tools before dependency install
 RUN pip install --no-cache-dir --upgrade "pip>=26.0" "wheel>=0.46.2" "setuptools>=75.0"
 RUN pip install --no-cache-dir -r requirements.txt
+RUN pip uninstall --yes pip setuptools wheel
 
 FROM python:3.14-alpine AS runtime
 
 WORKDIR /app
 
+RUN python -m pip uninstall --yes pip
+
 RUN apk add --no-cache \
     libgcc \
     libstdc++