diff --git a/web/Dockerfile b/web/Dockerfile
index 06d59463d..39e212359 100644
--- a/web/Dockerfile
+++ b/web/Dockerfile
@@ -59,13 +59,14 @@ ENV API_UPSTREAM=http://gameplane-api.gameplane-system.svc.cluster.local
 # (CVE-2026-111497) and curl/libcurl 8.22.0-r0 (CVE-2026-92392); Trivy fails
 # the publish on both. It also ships libexpat 2.9.0-r0 (CVE-2026-113351,
 # CVE-2026-115506, CVE-2026-117610, CVE-2026-118370), musl/musl-utils 1.2.6-r2
-# (CVE-2026-107891) and zlib 1.3.2-r0 (CVE-2026-85091). Upgrade them all to the
+# (CVE-2026-107891), zlib 1.3.2-r0 (CVE-2026-85091) and libxslt 1.1.43-r3
+# (CVE-2026-87636, CVE-2026-9947). Upgrade them all to the
 # Alpine 3.24 fixes as root, then drop back to the base image's unprivileged
 # nginx user (uid 101).
 USER root
 RUN apk add --no-cache brotli-libs~=1.2.1 curl~=8.23.0 libcurl~=8.23.0 \
       'libexpat>=2.10.0-r0' 'musl>=1.2.6-r3' 'musl-utils>=1.2.6-r3' \
-      'zlib>=1.3.2-r1'
+      'zlib>=1.3.2-r1' 'libxslt>=1.1.43-r4'
 USER 101
 
 # Replace the base image's default server block with ours.