diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2a02182e..2e31b202 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,10 @@
 
 - Fixture `citations` serve OpenAI Responses `url_citation` annotations; fixture `files` serve Gemini `inlineData` parts (#550 by @abhiaiyer91)
 
+### Fixed
+
+- Docker image: the base image is pinned to `node:22.23.4-alpine` by digest. Node 22.23.4 fixes CVE-2026-111497 (Brotli decompression memory bug); the 1.46.0 image shipped Node 22.23.3.
+
 ## [1.46.0] - 2026-10-20
 
 ### Added
diff --git a/Dockerfile b/Dockerfile
index 01ca05a4..999c2a8f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 
 # --- Build stage ---
-FROM node:22-alpine AS build
+FROM node:22.23.4-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914 AS build
 
 RUN corepack enable && corepack prepare pnpm@10.28.2 --activate
 
@@ -17,7 +17,7 @@ COPY src/ src/
 RUN pnpm run build
 
 # --- Production stage ---
-FROM node:22-alpine
+FROM node:22.23.4-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914
 
 LABEL org.opencontainers.image.title="aimock"
 LABEL org.opencontainers.image.description="Mock infrastructure for AI application testing"