diff --git a/images/agent-runtime/Dockerfile b/images/agent-runtime/Dockerfile
index f5b5cf7..b04c9fa 100644
--- a/images/agent-runtime/Dockerfile
+++ b/images/agent-runtime/Dockerfile
@@ -9,7 +9,7 @@
 # Framework toolchains (Rails, Django, ...) layer on top in Phase 3 — this
 # image stays agent-only.
 
-FROM node:22-bookworm-slim
+FROM node:22.23.4-bookworm-slim@sha256:de170b39439eb0e5a3444ad7d60b015614a381e10fecae2e30ec9e735122f38d
 
 ARG CLAUDE_CODE_VERSION=2.1.215
 ARG CODEX_VERSION=0.149.1
diff --git a/src/isolation/image-contexts.generated.ts b/src/isolation/image-contexts.generated.ts
index 090b828..085d271 100644
--- a/src/isolation/image-contexts.generated.ts
+++ b/src/isolation/image-contexts.generated.ts
@@ -23,7 +23,7 @@ export const IMAGE_CONTEXT_FILES: Record<string, string> = {
 # Framework toolchains (Rails, Django, ...) layer on top in Phase 3 — this
 # image stays agent-only.
 
-FROM node:22-bookworm-slim
+FROM node:22.23.4-bookworm-slim@sha256:de170b39439eb0e5a3444ad7d60b015614a381e10fecae2e30ec9e735122f38d
 
 ARG CLAUDE_CODE_VERSION=2.1.215
 ARG CODEX_VERSION=0.149.1