diff --git a/packages/backend/Dockerfile b/packages/backend/Dockerfile
index 3eb2d7c..1f24ceb 100644
--- a/packages/backend/Dockerfile
+++ b/packages/backend/Dockerfile
@@ -15,7 +15,7 @@
 # the monorepo root so `pnpm install --filter` can resolve the workspace.
 
 # ---------------------------------------------------------------- base -------
-FROM node:24.19.0-alpine AS base
+FROM node:24.20.0-alpine AS base
 # corepack enables pnpm without a global install (pin to the repo's packageManager).
 RUN corepack enable && corepack prepare pnpm@11.21.0 --activate
 ENV PNPM_HOME=/pnpm
diff --git a/packages/frontend/Dockerfile b/packages/frontend/Dockerfile
index 91464e4..5b3813b 100644
--- a/packages/frontend/Dockerfile
+++ b/packages/frontend/Dockerfile
@@ -10,7 +10,7 @@
 # Build context must be the monorepo root so pnpm can resolve the workspace.
 
 # ----------------------------------------------------------------- deps ------
-FROM node:24.19.0-alpine AS deps
+FROM node:24.20.0-alpine AS deps
 RUN corepack enable && corepack prepare pnpm@11.21.0 --activate
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
@@ -39,7 +39,7 @@ ENV VITE_USE_MOCK=${VITE_USE_MOCK}
 RUN pnpm --filter @peoplevate/frontend build
 
 # ----------------------------------------------------------------- web -------
-FROM nginx:1.27-alpine AS web
+FROM nginx:1.29-alpine AS web
 # Default conf served by nginx:1.27-alpine; remove the demo page.
 RUN rm -f /etc/nginx/conf.d/default.conf
 # Build context is the monorepo root, so the nginx.conf path is fully qualified.