@@ -7,28 +7,35 @@ FROM node:24
 
 WORKDIR /content-node
 
-# Only what the service imports, at the versions the root package.json pins,
-# read from it rather than restated here (as the render service does). The
-# repository's own lockfile would drag in Angular, Playwright and the CMS to
-# run two packages. A pin restated here stayed at express 5.2.1 when
-# Dependabot moved the root to 5.3.0 (it watches only the root), so the image
-# would have run a version nothing here tested.
+# Only what the service imports, at the versions the repository resolves and
+# tests: each must be a dependency of the root package.json, and is installed
+# at the version the root lockfile resolved for it. The repository's own
+# lockfile would drag in Angular, Playwright and the CMS to run two packages.
+# A pin restated here stayed at express 5.2.1 when Dependabot moved the root
+# to 5.3.0 (it watches only the root); a range read from package.json
+# (neo4j-driver's ^6.2.0) would take the newest 6.x at build time, untested.
+# Their own dependencies still resolve at build time, within express's and
+# the driver's ranges.
 COPY package.json ./root-package.json
+COPY package-lock.json ./root-lock.json
 RUN node -e " \
       const root = require('./root-package.json'); \
+      const lock = require('./root-lock.json'); \
       const dependencies = {}; \
       for (const name of ['express', 'neo4j-driver']) { \
-        const version = (root.dependencies ?? {})[name]; \
-        if (!version) throw new Error(name + ' is not a dependency of the root package'); \
-        dependencies[name] = version; \
+        if (!(root.dependencies ?? {})[name]) \
+          throw new Error(name + ' is not a dependency of the root package'); \
+        const locked = (lock.packages ?? {})['node_modules/' + name]; \
+        if (!locked?.version) throw new Error(name + ' is not in the root lockfile'); \
+        dependencies[name] = locked.version; \
       } \
       require('node:fs').writeFileSync('package.json', JSON.stringify({ \
         name: 'reactome-content-node', private: true, dependencies \
       }, null, 2)); \
     " \
     && npm install --omit=dev --no-audit --no-fund \
     && npm cache clean --force \
-    && rm root-package.json
+    && rm root-package.json root-lock.json
 
 COPY tools/content-node/ ./tools/content-node/
 # The nearest package.json is what tells Node a .ts module is a module (spec