diff --git a/Dockerfile b/Dockerfile
index 4ff2a56..828370d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,14 +4,14 @@
 # Dependabot (docker ecosystem) keeps the digest current.
 
 # Production dependencies — cached independently of source changes
-FROM node:24-slim@sha256:cb4e8f7c443347358b7875e717c29e27bf9befc8f5a26cf18af3c3dec80e58c5 AS prod-deps
+FROM node:26-slim@sha256:ffc78385a788964bb3cbab5e434ff79a10bdc25b8ae6db03fe5fe6cb14053c09 AS prod-deps
 WORKDIR /app
 COPY package.json package-lock.json ./
 # --ignore-scripts: the prepare script runs husky, a devDependency absent here
 RUN npm ci --omit=dev --ignore-scripts
 
 # Build stage: dev dependencies + TypeScript compile
-FROM node:24-slim@sha256:cb4e8f7c443347358b7875e717c29e27bf9befc8f5a26cf18af3c3dec80e58c5 AS build
+FROM node:26-slim@sha256:ffc78385a788964bb3cbab5e434ff79a10bdc25b8ae6db03fe5fe6cb14053c09 AS build
 WORKDIR /app
 COPY package.json package-lock.json ./
 # --ignore-scripts: skip husky's git-hook install — no .git in the image
@@ -21,7 +21,7 @@ COPY src ./src
 RUN npx tsc
 
 # Runtime stage: dist + production node_modules, nothing else
-FROM node:24-slim@sha256:cb4e8f7c443347358b7875e717c29e27bf9befc8f5a26cf18af3c3dec80e58c5
+FROM node:26-slim@sha256:ffc78385a788964bb3cbab5e434ff79a10bdc25b8ae6db03fe5fe6cb14053c09
 WORKDIR /app
 COPY --from=prod-deps /app/node_modules ./node_modules
 COPY --from=build /app/dist ./dist