diff --git a/Dockerfile b/Dockerfile
index 170b73acd..0b5962094 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-ARG NODE_IMAGE=node:26.11.1-alpine3.23@sha256:f1394b3ffc021bc3f4aaf363e70a8d9667f7a9a63538bc824d7cc583129fffad
+ARG NODE_IMAGE=node:26.12.1-alpine3.23@sha256:bc2b334006f15c7167bbeb2f08f28c2df883f7594a0470e04454ebe7560cfe68
 
 FROM ${NODE_IMAGE} AS base
 RUN npm install -g pnpm@11.22.0
diff --git a/workers/read-aloud/Dockerfile b/workers/read-aloud/Dockerfile
index 00e31138b..e9f4474e4 100644
--- a/workers/read-aloud/Dockerfile
+++ b/workers/read-aloud/Dockerfile
@@ -1,6 +1,6 @@
 # Debian trixie for ffmpeg 7: STAlign's audiobook probe passes `ffprobe -output_format`, which the
 # ffmpeg 5.1 in bookworm rejects, failing every job in its first stage.
-ARG NODE_IMAGE=node:26.8.1-trixie-slim
+ARG NODE_IMAGE=node:26.12.1-trixie-slim
 
 FROM ${NODE_IMAGE} AS builder
 WORKDIR /app