diff --git a/Dockerfile b/Dockerfile
index 76a12b8..cd22a53 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -28,7 +28,7 @@ COPY . .
 RUN bun scripts/build-standalone.ts --target bun-linux-x64-modern \
 	&& bun scripts/check-standalone.ts --target bun-linux-x64-modern --probe-binaries
 
-FROM node:24-bookworm-slim@sha256:2c87ef9bd3c6a3bd4b472b4bec2ce9d16354b0c574f736c476489d09f560a203
+FROM node:25-bookworm-slim@sha256:81db02c4b671288a03915da9534dbd54f96d0e7c24d80ccc54f5b36b2e684370
 
 # Defaults mirror AGENT_CLI_VERSIONS in scripts/docker-image.ts (the source
 # of truth — `bun run docker:build` passes them as --build-arg).