diff --git a/nginx/BUILD.bazel b/nginx/BUILD.bazel
index 45cf8f4..95855f3 100644
--- a/nginx/BUILD.bazel
+++ b/nginx/BUILD.bazel
@@ -77,9 +77,11 @@ oci_image(
         ":sh",
         ":passwd",
         ":group",
+        # The official NGINX package ships default config files. Layer the
+        # project configuration afterwards so it takes precedence.
+        "@nginx-bookworm//:flat",
         ":config.tar",
         ":conf.d.tar",
-        "@nginx-bookworm//:flat",
     ],
 )
 
diff --git a/nginx/bookworm.lock.json b/nginx/bookworm.lock.json
index 6fbfc30..f7d1ce6 100644
--- a/nginx/bookworm.lock.json
+++ b/nginx/bookworm.lock.json
@@ -3,13 +3,13 @@
 		{
 			"arch": "amd64",
 			"dependencies": [],
-			"key": "nginx_1.22.1-9-p-deb12u9_amd64",
+			"key": "nginx_1.31.8-1_bookworm_amd64",
 			"name": "nginx",
-			"sha256": "4e7b52f8b31f26d77ffb5c427c41e36223e81b047242ecfa8dc1d7f939734885",
+			"sha256": "6591c44bb94139916bf99e149857f5406006b3c7120b3b384dc0dddd97e5818c",
 			"urls": [
-				"https://snapshot.debian.org/archive/debian-security/20260716T114414Z/pool/updates/main/n/nginx/nginx_1.22.1-9+deb12u9_amd64.deb"
+				"https://nginx.org/packages/mainline/debian/pool/nginx/n/nginx/nginx_1.31.8-1~bookworm_amd64.deb"
 			],
-			"version": "1.22.1-9+deb12u9"
+			"version": "1.31.8-1~bookworm"
 		},
 		{
 			"arch": "amd64",
@@ -69,13 +69,13 @@
 		{
 			"arch": "arm64",
 			"dependencies": [],
-			"key": "nginx_1.22.1-9-p-deb12u9_arm64",
+			"key": "nginx_1.31.8-1_bookworm_arm64",
 			"name": "nginx",
-			"sha256": "c50ba73501e353702a748a57aab4817bfe7d1e8d6cc7a2e24c97248bd91462de",
+			"sha256": "730113cad444c6ea02011ddea712a0f81ab75b114b26602aca1d1e4926408155",
 			"urls": [
-				"https://snapshot.debian.org/archive/debian-security/20260716T114414Z/pool/updates/main/n/nginx/nginx_1.22.1-9+deb12u9_arm64.deb"
+				"https://nginx.org/packages/mainline/debian/pool/nginx/n/nginx/nginx_1.31.8-1~bookworm_arm64.deb"
 			],
-			"version": "1.22.1-9+deb12u9"
+			"version": "1.31.8-1~bookworm"
 		},
 		{
 			"arch": "arm64",
diff --git a/nginx/bookworm.yaml b/nginx/bookworm.yaml
index 504d1ea..febf62b 100644
--- a/nginx/bookworm.yaml
+++ b/nginx/bookworm.yaml
@@ -1,6 +1,10 @@
 version: 1
 
 sources:
+  # NGINX 1.31.7 fixes CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176.
+  # Use the official mainline repository because Debian bookworm only ships 1.22.
+  - channel: bookworm nginx
+    url: https://nginx.org/packages/mainline/debian
   - channel: bookworm main contrib
     url: https://snapshot.debian.org/archive/debian/20260716T082409Z
   - channel: bookworm-security main
@@ -14,7 +18,7 @@ archs:
 
 packages:
   # Packages
-  - nginx
+  - nginx (= 1.31.8-1~bookworm)
 
   # Dependencies
   - libc6
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index e8d5c40..d60c1b9 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -1,4 +1,5 @@
 user www-data;
+pid /run/nginx.pid;
 worker_processes auto;
 
 http {