diff --git a/Dockerfile.test b/Dockerfile.test
index c81a9f3a8c..0af87d5ab7 100644
--- a/Dockerfile.test
+++ b/Dockerfile.test
@@ -10,7 +10,7 @@
 #   docker run --rm -v ./packages/producer/tests:/app/packages/producer/tests hyperframes-producer:test
 #   docker run --rm -v ./packages/producer/tests:/app/packages/producer/tests hyperframes-producer:test --update
 
-FROM node:22.23.3-bookworm-slim
+FROM node:22.23.4-bookworm-slim
 
 # ── System dependencies (identical to production) ────────────────────────────
 RUN apt-get update && apt-get install -y --no-install-recommends \
diff --git a/packages/cli/src/docker/Dockerfile.render b/packages/cli/src/docker/Dockerfile.render
index 2ff9f3cb0b..9667dc6f1f 100644
--- a/packages/cli/src/docker/Dockerfile.render
+++ b/packages/cli/src/docker/Dockerfile.render
@@ -1,4 +1,4 @@
-FROM node:22.23.3-bookworm-slim
+FROM node:22.23.4-bookworm-slim
 
 ARG HYPERFRAMES_VERSION=latest
 # Set automatically by `docker build --platform` (BuildKit); selects the
diff --git a/packages/gcp-cloud-run/Dockerfile b/packages/gcp-cloud-run/Dockerfile
index db92bdbc6c..9466c7069c 100644
--- a/packages/gcp-cloud-run/Dockerfile
+++ b/packages/gcp-cloud-run/Dockerfile
@@ -21,7 +21,7 @@
 # Unlike the AWS Lambda adapter there is no ZIP-size ceiling and no runtime
 # Chrome decompression step — the binary lives in the image at a fixed path.
 
-FROM node:22.23.3-bookworm-slim AS beginframe-contract
+FROM node:22.23.4-bookworm-slim AS beginframe-contract
 
 # ── System dependencies (identical set to the producer's render image) ───────
 RUN apt-get update && apt-get install -y --no-install-recommends \