diff --git a/web/Dockerfile b/web/Dockerfile
index 3b2c7d46a..3f9eb8742 100644
--- a/web/Dockerfile
+++ b/web/Dockerfile
@@ -57,10 +57,15 @@ ENV API_UPSTREAM=http://gameplane-api.gameplane-system.svc.cluster.local
 
 # The base image (last rebuilt 2026-10-19) ships brotli-libs 1.2.0-r1
 # (CVE-2026-111497) and curl/libcurl 8.22.0-r0 (CVE-2026-92392); Trivy fails
-# the publish on both. Upgrade them to the Alpine 3.24 fixes as root, then drop
-# back to the base image's unprivileged nginx user (uid 101).
+# the publish on both. It also ships libexpat 2.9.0-r0 (CVE-2026-113351,
+# CVE-2026-115506, CVE-2026-117610, CVE-2026-118370), musl/musl-utils 1.2.6-r2
+# (CVE-2026-107891) and zlib 1.3.2-r0 (CVE-2026-85091). Upgrade them all to the
+# Alpine 3.24 fixes as root, then drop back to the base image's unprivileged
+# nginx user (uid 101).
 USER root
-RUN apk add --no-cache brotli-libs~=1.2.1 curl~=8.23.0 libcurl~=8.23.0
+RUN apk add --no-cache brotli-libs~=1.2.1 curl~=8.23.0 libcurl~=8.23.0 \
+      'libexpat>=2.10.0-r0' 'musl>=1.2.6-r3' 'musl-utils>=1.2.6-r3' \
+      'zlib>=1.3.2-r1'
 USER 101
 
 # Replace the base image's default server block with ours.