diff --git a/images/ci-tools/Dockerfile b/images/ci-tools/Dockerfile
index 1c85116..e704480 100644
--- a/images/ci-tools/Dockerfile
+++ b/images/ci-tools/Dockerfile
@@ -10,7 +10,7 @@
 # FROM, and an `ARG BASE_IMAGE` reference would silence its base-image updates.
 # The two FROM lines must stay identical — the native .so modules built here
 # load under the final stage's interpreter and need the same glibc ABI.
-FROM node:26-bookworm-slim@sha256:b16ca7b4dcfb20184e1c70f9ee30c6a75ed1da669cfafd6d2add4761b123d79f AS lua-builder
+FROM node:26-bookworm-slim@sha256:e999d087492c7227c85adc70574cf9d3cce774c3e6d7b8dfe473ee6b142c8f2c AS lua-builder
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
@@ -40,7 +40,7 @@ RUN luarocks --lua-version=5.4 install busted "${BUSTED_VERSION}" \
 
 # ---------- final image ----------
 # Base digest duplicated from lua-builder for Dependabot — see the note there.
-FROM node:26-bookworm-slim@sha256:b16ca7b4dcfb20184e1c70f9ee30c6a75ed1da669cfafd6d2add4761b123d79f
+FROM node:26-bookworm-slim@sha256:e999d087492c7227c85adc70574cf9d3cce774c3e6d7b8dfe473ee6b142c8f2c
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]