diff --git a/docker/hyperdx/Dockerfile b/docker/hyperdx/Dockerfile
index 6a3321822a..6ffb331ad4 100644
--- a/docker/hyperdx/Dockerfile
+++ b/docker/hyperdx/Dockerfile
@@ -7,7 +7,12 @@
 # - Mongo
 # - Otel Collector (otelcol)
 
-ARG NODE_VERSION=22.22
+# Pinned by digest: the multi-arch index of node:22.23.4-alpine3.24 (Node security
+# release for CVE-2026-111497 Brotli, plus the 22.23.4 TLS/DNS fixes). Bump
+# NODE_VERSION and NODE_DIGEST together; get the digest with
+# `crane digest node:<version>-alpine3.24`.
+ARG NODE_VERSION=22.23.4
+ARG NODE_DIGEST=sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914
 ARG CLICKHOUSE_VERSION=26.8
 ARG OTEL_COLLECTOR_VERSION=0.155.0
 ARG OTEL_COLLECTOR_CORE_VERSION=1.61.0
@@ -42,7 +47,7 @@ RUN go mod download
 COPY packages/otel-collector/ ./
 RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /migrate ./cmd/migrate
 
-FROM node:${NODE_VERSION}-alpine AS node_base
+FROM node:${NODE_VERSION}-alpine3.24@${NODE_DIGEST} AS node_base
 
 WORKDIR /app
 
@@ -104,7 +109,7 @@ RUN --mount=type=cache,target=/root/.yarn/berry/cache,id=yarn-cache \
 
 
 # prod ############################################################################################
-FROM node:${NODE_VERSION}-alpine AS prod
+FROM node:${NODE_VERSION}-alpine3.24@${NODE_DIGEST} AS prod
 
 LABEL org.opencontainers.image.vendor="HyperDX" \
       org.opencontainers.image.title="HyperDX Production" \
diff --git a/package.json b/package.json
index 6659ab07d9..26f0a2d198 100644
--- a/package.json
+++ b/package.json
@@ -86,7 +86,8 @@
     "on-headers": "^1.1.0",
     "fast-xml-parser": "^4.5.6",
     "systeminformation": "^5.24.0",
-    "@asyncapi/specs": "6.11.1"
+    "@asyncapi/specs": "6.11.1",
+    "@hyperdx/otel-web-session-recorder/protobufjs": "~6.11.6"
   },
   "resolutionsNotes": {
     "@stryker-mutator/core/minimatch": "Dev tooling, not a CVE override. Added when a blanket `brace-expansion` pin forced v2 (CJS) while minimatch v10 needs v5's named exports. That blanket pin is gone — it broke `nx affected` the same way — so brace-expansion now resolves per consumer and Stryker would most likely work on minimatch v10. The pin stays because no CI job runs `yarn dev:mutation`, so nothing would catch it if that guess is wrong. Drop it once someone has run the mutation suite on v10. See CONTRIBUTING.md#mutation-tests."
diff --git a/yarn.lock b/yarn.lock
index 3df33950e2..1af4d01d09 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -25965,9 +25965,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"protobufjs@npm:~6.11.2":
-  version: 6.11.4
-  resolution: "protobufjs@npm:6.11.4"
+"protobufjs@npm:~6.11.6":
+  version: 6.11.6
+  resolution: "protobufjs@npm:6.11.6"
   dependencies:
     "@protobufjs/aspromise": "npm:^1.1.2"
     "@protobufjs/base64": "npm:^1.1.2"
@@ -25985,7 +25985,7 @@ __metadata:
   bin:
     pbjs: bin/pbjs
     pbts: bin/pbts
-  checksum: 10c0/c244d7b9b6d3258193da5c0d1e558dfb47f208ae345e209f90ec45c9dca911b90fa17e937892a9a39a4136ab9886981aae9efdf6039f7baff4f7225f5eeb9812
+  checksum: 10c0/a7ed63a75b86c7d22abdfef48e9775f373befbaad4beceadf5bd047066365d735386d57851b35f89ae2c1afdea2da1c93a17682aa9a4a8f3df7ca54ccdce309b
   languageName: node
   linkType: hard