diff --git a/deploy/docker/Dockerfile.server b/deploy/docker/Dockerfile.server
index 266858b9..bf7cda45 100644
--- a/deploy/docker/Dockerfile.server
+++ b/deploy/docker/Dockerfile.server
@@ -1,5 +1,5 @@
 # Stage 1: Build
-FROM rust:1.99-bookworm AS builder
+FROM rust:1.100-bookworm AS builder
 
 WORKDIR /app
 COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
diff --git a/deploy/docker/Dockerfile.web b/deploy/docker/Dockerfile.web
index d8ce3678..b519a2a3 100644
--- a/deploy/docker/Dockerfile.web
+++ b/deploy/docker/Dockerfile.web
@@ -6,7 +6,7 @@
 # `pnpm install` and `pnpm build` under QEMU: the build alone took 260s
 # against 23s natively, and when Node crashed there with SIGILL the step
 # never exited — the CI job sat idle until GitHub's six-hour limit.
-FROM --platform=$BUILDPLATFORM node:24.22.0-alpine AS builder
+FROM --platform=$BUILDPLATFORM node:24.22.3-alpine AS builder
 
 # Pin pnpm to a known-good 12.x, matching `packageManager` in
 # web/package.json. The workspace YAML's `allowBuilds` field requires