diff --git a/Dockerfile b/Dockerfile
index 10bbc2c..4e2ab83 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,7 @@
 # The backend serves the SPA itself (app.frontend on repo-root dist/), so the
 # image carries its own frontend build — one artifact, no tag-sync with a
 # separately-shipped UI.
-FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2 AS spa
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS spa
 WORKDIR /app/frontend
 COPY frontend/package.json frontend/package-lock.json* ./
 RUN npm ci