diff --git a/Dockerfile.test b/Dockerfile.test
index c81a9f3a8c..4e6cf42d80 100644
--- a/Dockerfile.test
+++ b/Dockerfile.test
@@ -10,7 +10,7 @@
 #   docker run --rm -v ./packages/producer/tests:/app/packages/producer/tests hyperframes-producer:test
 #   docker run --rm -v ./packages/producer/tests:/app/packages/producer/tests hyperframes-producer:test --update
 
-FROM node:22.23.3-bookworm-slim
+FROM node:22.23.4-bookworm-slim
 
 # ── System dependencies (identical to production) ────────────────────────────
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -88,7 +88,7 @@ RUN npx --yes @puppeteer/browsers install chrome-headless-shell@152.0.7977.30 \
 WORKDIR /app
 
 # Install bun
-RUN curl -fsSL https://bun.sh/install | BUN_INSTALL="/root/.bun" bash -s "bun-v1.3.13"
+RUN curl -fsSL https://bun.sh/install | BUN_INSTALL="/root/.bun" bash -s "bun-v1.4.4"
 ENV PATH="/root/.bun/bin:$PATH"
 
 # Install dependencies (full, including devDependencies for tsx + test harness).
diff --git a/packages/cli/src/docker/Dockerfile.render b/packages/cli/src/docker/Dockerfile.render
index 2ff9f3cb0b..9667dc6f1f 100644
--- a/packages/cli/src/docker/Dockerfile.render
+++ b/packages/cli/src/docker/Dockerfile.render
@@ -1,4 +1,4 @@
-FROM node:22.23.3-bookworm-slim
+FROM node:22.23.4-bookworm-slim
 
 ARG HYPERFRAMES_VERSION=latest
 # Set automatically by `docker build --platform` (BuildKit); selects the
diff --git a/packages/gcp-cloud-run/Dockerfile b/packages/gcp-cloud-run/Dockerfile
index db92bdbc6c..ec2541392c 100644
--- a/packages/gcp-cloud-run/Dockerfile
+++ b/packages/gcp-cloud-run/Dockerfile
@@ -21,7 +21,7 @@
 # Unlike the AWS Lambda adapter there is no ZIP-size ceiling and no runtime
 # Chrome decompression step — the binary lives in the image at a fixed path.
 
-FROM node:22.23.3-bookworm-slim AS beginframe-contract
+FROM node:22.23.4-bookworm-slim AS beginframe-contract
 
 # ── System dependencies (identical set to the producer's render image) ───────
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -100,7 +100,7 @@ WORKDIR /app
 # the container runs `bun dist/server.js` and relies on bun's ESM `require`
 # interop to load the producer bundle, so a future bun release changing that
 # behaviour shouldn't silently break the next image rebuild. Bump deliberately.
-RUN curl -fsSL https://bun.sh/install | bash -s "bun-v1.4.2"
+RUN curl -fsSL https://bun.sh/install | bash -s "bun-v1.4.4"
 ENV PATH="/root/.bun/bin:$PATH"
 
 # Install workspace dependencies. Copy manifests first for layer caching.