diff --git a/Dockerfile b/Dockerfile
index 7f5cca2..b74758c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,7 @@
 # ---------- build base ----------
 # Pin npm separately because the Node image's bundled npm can lag the project
 # package-manager contract and silently ignore strict install-script policy.
-FROM node:24.15.0-bookworm-slim@sha256:4e6b70dd6cbfc88c8157ba19aa3d9f9cce6ba4703576d55459e45efcbc9c5f5d AS build-base
+FROM node:26.7.0-bookworm-slim@sha256:cd565714d4da3e84bfd341e31448f81d47c6362198f152345297c9c1154e6341 AS build-base
 ARG NPM_VERSION=11.16.0
 RUN npm install --global "npm@${NPM_VERSION}" \
   && test "$(npm --version)" = "${NPM_VERSION}"
@@ -40,7 +40,7 @@ COPY . .
 RUN npm run build
 
 # ---------- runner ----------
-FROM node:24.15.0-bookworm-slim@sha256:4e6b70dd6cbfc88c8157ba19aa3d9f9cce6ba4703576d55459e45efcbc9c5f5d AS runner
+FROM node:26.7.0-bookworm-slim@sha256:cd565714d4da3e84bfd341e31448f81d47c6362198f152345297c9c1154e6341 AS runner
 WORKDIR /app
 
 # yt-dlp's official Unix zipimport executable is architecture-independent. Pin
diff --git a/Dockerfile.youtube-pot-provider b/Dockerfile.youtube-pot-provider
index 56948d5..ad63e7f 100644
--- a/Dockerfile.youtube-pot-provider
+++ b/Dockerfile.youtube-pot-provider
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.7
 
-FROM node:24.15.0-bookworm-slim@sha256:4e6b70dd6cbfc88c8157ba19aa3d9f9cce6ba4703576d55459e45efcbc9c5f5d AS source
+FROM node:26.7.0-bookworm-slim@sha256:cd565714d4da3e84bfd341e31448f81d47c6362198f152345297c9c1154e6341 AS source
 
 USER root
 RUN apt-get update \
@@ -20,7 +20,7 @@ RUN --mount=type=cache,target=/home/node/.npm,uid=1000,gid=1000 \
     npm ci --no-audit --no-fund
 RUN npx tsc
 
-FROM node:24.15.0-bookworm-slim@sha256:4e6b70dd6cbfc88c8157ba19aa3d9f9cce6ba4703576d55459e45efcbc9c5f5d AS runtime
+FROM node:26.7.0-bookworm-slim@sha256:cd565714d4da3e84bfd341e31448f81d47c6362198f152345297c9c1154e6341 AS runtime
 
 ENV NODE_ENV=production
 USER node