diff --git a/Dockerfile b/Dockerfile
index e68e639..dbaf19a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,7 +15,7 @@
 # digest for reproducible builds. This is the multi-arch manifest-list digest,
 # so the amd64 + arm64 publish both resolve from it. Dependabot (docker
 # ecosystem, weekly) bumps the tag + digest when a new 24-alpine ships.
-FROM node:24-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd AS base
+FROM node:25-alpine@sha256:bdf2cca6fe3dabd014ea60163eca3f0f7015fbd5c7ee1b0e9ccb4ced6eb02ef4 AS base
 
 ARG VERSION
 WORKDIR /src