diff --git a/.mise.toml b/.mise.toml
index 4a23b0a4..cb8e03cb 100644
--- a/.mise.toml
+++ b/.mise.toml
@@ -1,5 +1,5 @@
 [tools]
-node = "22"
+node = "22.23.4"
 pnpm = "9.15.0"
 kubectl = "latest"
 helm = "latest"
diff --git a/.nvmrc b/.nvmrc
index 2bd5a0a9..b8b23ca9 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-22
+22.23.4
diff --git a/Dockerfile b/Dockerfile
index f877ab10..b9b4d2c5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM node:22-slim AS base
+FROM node:22.23.4-slim AS base
 
 ARG PORT
 
diff --git a/base.Dockerfile b/base.Dockerfile
index e41d5e96..b6c39b4a 100644
--- a/base.Dockerfile
+++ b/base.Dockerfile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM node:22-slim
+FROM node:22.23.4-slim
 
 ARG TARGETARCH
 
diff --git a/scripts/e2b/e2b.Dockerfile b/scripts/e2b/e2b.Dockerfile
index 8e055dd3..fae009f0 100644
--- a/scripts/e2b/e2b.Dockerfile
+++ b/scripts/e2b/e2b.Dockerfile
@@ -9,7 +9,7 @@
 # Keep this self-contained instead of depending on lifecycleoss/workspace:latest; the E2B
 # remote builder needs every gateway contract change baked into the template deterministically.
 
-FROM node:22-slim
+FROM node:22.23.4-slim
 
 ENV HOME=/home/agent
 ENV BUN_INSTALL=/home/agent/.bun
diff --git a/sysops/dockerfiles/agent.Dockerfile b/sysops/dockerfiles/agent.Dockerfile
index d97004d4..227a7cc5 100644
--- a/sysops/dockerfiles/agent.Dockerfile
+++ b/sysops/dockerfiles/agent.Dockerfile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM node:22-slim
+FROM node:22.23.4-slim
 
 ENV HOME=/home/agent
 ENV BUN_INSTALL=/home/agent/.bun
diff --git a/sysops/dockerfiles/tilt.app.Dockerfile b/sysops/dockerfiles/tilt.app.Dockerfile
index b650399e..93727824 100644
--- a/sysops/dockerfiles/tilt.app.Dockerfile
+++ b/sysops/dockerfiles/tilt.app.Dockerfile
@@ -14,7 +14,7 @@
 # limitations under the License.
 
 # Use a common base image for both stages
-FROM node:22-slim
+FROM node:22.23.4-slim
 
 # Set environment variables
 ENV PNPM_HOME="/pnpm"
diff --git a/sysops/dockerfiles/workspace-gateway.Dockerfile b/sysops/dockerfiles/workspace-gateway.Dockerfile
index 4c6eb4a2..dcc02236 100644
--- a/sysops/dockerfiles/workspace-gateway.Dockerfile
+++ b/sysops/dockerfiles/workspace-gateway.Dockerfile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM node:22-slim
+FROM node:22.23.4-slim
 
 ENV NPM_CONFIG_UPDATE_NOTIFIER=false
 ENV NODE_ENV=production