diff --git a/CHANGELOG.md b/CHANGELOG.md
index c1df382b6..a157389cf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Upgraded `curl`/`libcurl` in the Docker image to `8.20.0-r0` to address CVE-2026-6253. [#1451](https://github.com/sourcebot-dev/sourcebot/pull/1451)
+
 ## [5.1.1] - 2026-07-14
 
 - Add book a call button to sidebar. [#1441](https://github.com/sourcebot-dev/sourcebot/pull/1441)
diff --git a/Dockerfile b/Dockerfile
index 4a1b016c7..f7f24dbd0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -166,7 +166,10 @@ ENV SOURCEBOT_LOG_LEVEL=info
 # ENV SOURCEBOT_TELEMETRY_DISABLED=1
 
 # Configure dependencies
-RUN apk add --no-cache git ca-certificates bind-tools tini jansson wget supervisor uuidgen curl perl jq openssl util-linux unzip && \
+# curl/libcurl are pinned to the patched version for CVE-2026-6253 (proxy
+# credential disclosure). The explicit pin also invalidates the build cache so
+# rebuilds pick up the fix rather than reusing a stale layer.
+RUN apk add --no-cache git ca-certificates bind-tools tini jansson wget supervisor uuidgen "curl>=8.20.0-r0" perl jq openssl util-linux unzip && \
     apk upgrade --no-cache
 
 # Remove npm (unused — we use Yarn). The Node.js base image bundles npm