diff --git a/architecture/build.md b/architecture/build.md
index 5f3b913e1b..282bdc2332 100644
--- a/architecture/build.md
+++ b/architecture/build.md
@@ -219,6 +219,8 @@ Runtime layout:
   gateway binaries must not reference `GLIBC_*` symbols newer than
   `GLIBC_2.28`; release workflows verify this before publishing artifacts. The
   gateway bundles z3, so the image does not need a distro-provided z3 runtime.
+  The base is pinned to a multi-architecture digest; distro security updates
+  require refreshing that digest and rebuilding the gateway image.
 - **VM driver**: host GNU-linked binary installed at
   `/usr/libexec/openshell/openshell-driver-vm` in Linux packages and published
   as a release artifact. Linux GNU VM driver binaries must not reference
@@ -229,7 +231,8 @@ Runtime layout:
   cache action runs. An explicitly configured VM runtime bundle is required to
   contain every non-empty embedding input; the driver build fails before
   packaging when an input is absent or empty.
-- **Supervisor**: Alpine base with `nftables`, static binary at
+- **Supervisor**: Alpine base with `nftables`; base packages are upgraded before
+  installing firewall tools to pick up distro security fixes. Static binary at
   `/openshell-sandbox` (musl by default; see `SUPERVISOR_LIBC` above). Static
   linkage keeps the binary usable when the image is mounted/extracted into
   sandbox environments (Docker extraction, Podman image volumes, Kubernetes
diff --git a/deploy/docker/Dockerfile.gateway b/deploy/docker/Dockerfile.gateway
index cf68dc967a..52f2b27db3 100644
--- a/deploy/docker/Dockerfile.gateway
+++ b/deploy/docker/Dockerfile.gateway
@@ -8,7 +8,7 @@
 #
 # Distroless Debian provides the glibc runtime required by the binary.
 
-ARG GATEWAY_BASE_IMAGE=gcr.io/distroless/cc-debian13:nonroot@sha256:d97bc0a941b8d4be647dc0ee75b264ddbb772f1ac5ba690a4309c00723b23775
+ARG GATEWAY_BASE_IMAGE=gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c
 FROM ${GATEWAY_BASE_IMAGE} AS gateway
 
 ARG TARGETARCH
diff --git a/deploy/docker/Dockerfile.supervisor b/deploy/docker/Dockerfile.supervisor
index d515fd70b1..7e7342ccb3 100644
--- a/deploy/docker/Dockerfile.supervisor
+++ b/deploy/docker/Dockerfile.supervisor
@@ -12,7 +12,9 @@ FROM alpine:3.22 AS supervisor
 
 ARG TARGETARCH
 
-RUN apk add --no-cache nftables iptables iptables-legacy
+# Refresh base packages too: adding firewall tools does not upgrade OpenSSL.
+RUN apk upgrade --no-cache \
+    && apk add --no-cache nftables iptables iptables-legacy
 
 # Keep the binary root-owned for Podman image-volume mounts and executable by
 # the Kubernetes network sidecar's non-root proxy UID.
diff --git a/scripts/lint-mermaid/package-lock.json b/scripts/lint-mermaid/package-lock.json
index 1fa73b21e6..fcb8c01d19 100644
--- a/scripts/lint-mermaid/package-lock.json
+++ b/scripts/lint-mermaid/package-lock.json
@@ -1114,10 +1114,9 @@
       }
     },
     "node_modules/dompurify": {
-      "version": "3.4.12",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz",
-      "integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==",
-      "license": "(MPL-2.0 OR Apache-2.0)",
+      "version": "3.4.15",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.15.tgz",
+      "integrity": "sha512-EUBjM+B+lkDE41iE82DDSCfkoPGfXx8IxFxPMjNzm/Uk4xDet77rTN9wqlxlVg71kK7XGuUMv6wUxJUwwv+Xyw==",
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"
       }
diff --git a/scripts/lint-mermaid/package.json b/scripts/lint-mermaid/package.json
index a8c3aa2025..271bb08043 100644
--- a/scripts/lint-mermaid/package.json
+++ b/scripts/lint-mermaid/package.json
@@ -9,6 +9,6 @@
     "mermaid": "^11.4.0"
   },
   "overrides": {
-    "dompurify": "3.4.12"
+    "dompurify": "3.4.15"
   }
 }
diff --git a/skills/debug-openshell-cluster/SKILL.md b/skills/debug-openshell-cluster/SKILL.md
index 01943df044..360bf28ee4 100644
--- a/skills/debug-openshell-cluster/SKILL.md
+++ b/skills/debug-openshell-cluster/SKILL.md
@@ -456,6 +456,13 @@ helm -n openshell get values openshell | grep -E 'repository|tag|supervisorImage
 
 The gateway and supervisor images should use the same release tag. A stale supervisor image can make sandbox behavior lag behind gateway policy or protocol changes.
 
+For vulnerability reports, record the running image digest and scan that exact
+artifact. The gateway includes a pinned Distroless base; the supervisor includes
+Alpine packages updated at image build time. A dependency or base-image fix only
+reaches deployed containers after rebuilding, publishing, and redeploying the
+images. Compare findings against the SBOM for that digest, not just its mutable
+`latest` or `dev` tag.
+
 For plaintext local evaluation, confirm the chart has:
 
 ```bash