diff --git a/images/ansible-mcp/Dockerfile b/images/ansible-mcp/Dockerfile
index 54eed82..5fede00 100644
--- a/images/ansible-mcp/Dockerfile
+++ b/images/ansible-mcp/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:24-alpine3.24@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 AS build
+FROM node:24-alpine3.24@sha256:44fce696f38ba8c987c4db89954051000bbd05ffd8d8659ba15ed4a8602e937f AS build
 
 ARG VERSION
 WORKDIR /app
diff --git a/images/tailscale-exit-nodes/Dockerfile b/images/tailscale-exit-nodes/Dockerfile
index b23e991..eeca667 100644
--- a/images/tailscale-exit-nodes/Dockerfile
+++ b/images/tailscale-exit-nodes/Dockerfile
@@ -4,7 +4,7 @@
 # suite gates the image here: the `build` stage runs lint + typecheck + vitest
 # (npm run check) before compiling, so a failing test fails the image build.
 
-FROM node:24-alpine3.24@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 AS build
+FROM node:24-alpine3.24@sha256:44fce696f38ba8c987c4db89954051000bbd05ffd8d8659ba15ed4a8602e937f AS build
 WORKDIR /app
 # Install all deps (incl. dev) for the gate + compile. `npm ci` installs the
 # locked tree exactly, so an upstream publish cannot change deps under a
@@ -17,12 +17,12 @@ COPY . .
 RUN npm run check && npm run build
 
 # Production dependencies only, in a clean layer for the runtime image.
-FROM node:24-alpine3.24@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 AS prod-deps
+FROM node:24-alpine3.24@sha256:44fce696f38ba8c987c4db89954051000bbd05ffd8d8659ba15ed4a8602e937f AS prod-deps
 WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci --omit=dev --no-audit --no-fund && npm cache clean --force
 
-FROM node:24-alpine3.24@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 AS runtime
+FROM node:24-alpine3.24@sha256:44fce696f38ba8c987c4db89954051000bbd05ffd8d8659ba15ed4a8602e937f AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
 COPY --from=prod-deps /app/node_modules ./node_modules