diff --git a/deploy/Dockerfile b/deploy/Dockerfile
index 5f0aeb4..3f6b4ab 100644
--- a/deploy/Dockerfile
+++ b/deploy/Dockerfile
@@ -23,7 +23,7 @@
 # the bytes CI scanned. Dependabot proposes the digest's updates.
 
 # ─── Stage 1: compile, then cut node_modules down to production ───
-FROM node:24-alpine@sha256:a34ab6d7f6f4813f4d0c5469d74685604b962fbdbf5793a7bc7b4998ecb867c8 AS build
+FROM node:25-alpine@sha256:bdf2cca6fe3dabd014ea60163eca3f0f7015fbd5c7ee1b0e9ccb4ced6eb02ef4 AS build
 WORKDIR /src
 
 COPY package.json package-lock.json tsconfig.base.json ./