diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a542cef..0dc8899 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -131,6 +131,10 @@ updates:
       # together on purpose. Patch and digest updates still flow through.
       - dependency-name: "python"
         update-types: ["version-update:semver-major", "version-update:semver-minor"]
+      # Tags like "3.14-slim" slip past update-types, so also cap by version.
+      # Raise this together with the .python-version files.
+      - dependency-name: "python"
+        versions: [">=3.15"]
     schedule:
       interval: "monthly"
       day: "monday"
diff --git a/api/Dockerfile b/api/Dockerfile
index 73747fa..43cfd61 100644
--- a/api/Dockerfile
+++ b/api/Dockerfile
@@ -1,5 +1,5 @@
 # Python version comes from api/.python-version (CI checks they agree).
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 AS builder
+FROM python:3.14-slim@sha256:cd89c30eda26ee911a4611b18680086e0ea42e6f5f8cbe653d07fa7958c9cec8 AS builder
 
 # Install exactly what uv.lock pins: no resolution at build time.
 COPY --from=ghcr.io/astral-sh/uv:0.10.11 /uv /bin/uv
@@ -15,7 +15,7 @@ RUN uv sync --frozen --no-dev --no-install-project
 COPY src/ src/
 RUN uv sync --frozen --no-dev --no-editable
 
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170
+FROM python:3.14-slim@sha256:cd89c30eda26ee911a4611b18680086e0ea42e6f5f8cbe653d07fa7958c9cec8
 # The app runs from /app/.venv; the base image's pip (and the packages it
 # vendors) is never used at runtime, so it is removed rather than shipped.
 RUN useradd --uid 65532 --user-group --no-create-home app \
diff --git a/mcp/Dockerfile b/mcp/Dockerfile
index b85381c..525e346 100644
--- a/mcp/Dockerfile
+++ b/mcp/Dockerfile
@@ -1,5 +1,5 @@
 # Python version comes from mcp/.python-version (CI checks they agree).
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 AS builder
+FROM python:3.14-slim@sha256:cd89c30eda26ee911a4611b18680086e0ea42e6f5f8cbe653d07fa7958c9cec8 AS builder
 
 # Install exactly what uv.lock pins: no resolution at build time.
 COPY --from=ghcr.io/astral-sh/uv:0.10.11 /uv /bin/uv
@@ -15,7 +15,7 @@ RUN uv sync --frozen --no-dev --no-install-project
 COPY src/ src/
 RUN uv sync --frozen --no-dev --no-editable
 
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170
+FROM python:3.14-slim@sha256:cd89c30eda26ee911a4611b18680086e0ea42e6f5f8cbe653d07fa7958c9cec8
 # The app runs from /app/.venv; the base image's pip (and the packages it
 # vendors) is never used at runtime, so it is removed rather than shipped.
 RUN useradd --uid 65532 --user-group --no-create-home app \
diff --git a/operator/Dockerfile b/operator/Dockerfile
index c35612e..90badc7 100644
--- a/operator/Dockerfile
+++ b/operator/Dockerfile
@@ -1,7 +1,7 @@
 # The builder runs natively and cross-compiles (GOARCH below), instead of
 # running the whole Go toolchain under emulation for non-native platforms.
 # Go version matches the toolchain line in go.mod (CI checks they agree).
-FROM --platform=$BUILDPLATFORM golang:1.27.3@sha256:f24164268fc1e741bbdc0066dbadcf1c8426c5a8489f0729c02c3905a53032fd AS builder
+FROM --platform=$BUILDPLATFORM golang:1.27.3@sha256:2920bb124f1a2e12a1d39f0cab756ae0068441ee1da7655dec7f5e374944095b AS builder
 ARG TARGETOS=linux
 ARG TARGETARCH
 
@@ -16,7 +16,7 @@ COPY internal/ internal/
 RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
     go build -a -o apps-operator ./cmd
 
-FROM gcr.io/distroless/static:nonroot@sha256:d62067879de890a1def9da0e7766b7d20810a5e5555cef8506b752437d7a3e88
+FROM gcr.io/distroless/static:nonroot@sha256:25ac8f0c3b2334a9eb05452266bd4697864a8c8ef0ef71e5e6480d7f92868329
 WORKDIR /
 COPY --from=builder /workspace/apps-operator .
 USER 65532:65532
diff --git a/proxy/Dockerfile b/proxy/Dockerfile
index f89dbb9..fa5187e 100644
--- a/proxy/Dockerfile
+++ b/proxy/Dockerfile
@@ -1,7 +1,7 @@
 # The builder runs natively and cross-compiles (GOARCH below), instead of
 # running the whole Go toolchain under emulation for non-native platforms.
 # Go version matches the toolchain line in go.mod (CI checks they agree).
-FROM --platform=$BUILDPLATFORM golang:1.27.3@sha256:f24164268fc1e741bbdc0066dbadcf1c8426c5a8489f0729c02c3905a53032fd AS builder
+FROM --platform=$BUILDPLATFORM golang:1.27.3@sha256:2920bb124f1a2e12a1d39f0cab756ae0068441ee1da7655dec7f5e374944095b AS builder
 ARG TARGETOS=linux
 ARG TARGETARCH
 
@@ -15,7 +15,7 @@ COPY internal/ internal/
 RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
     go build -trimpath -ldflags="-s -w" -o apps-proxy .
 
-FROM gcr.io/distroless/static:nonroot@sha256:d62067879de890a1def9da0e7766b7d20810a5e5555cef8506b752437d7a3e88
+FROM gcr.io/distroless/static:nonroot@sha256:25ac8f0c3b2334a9eb05452266bd4697864a8c8ef0ef71e5e6480d7f92868329
 WORKDIR /
 COPY --from=builder /workspace/apps-proxy .
 USER 65532:65532
diff --git a/ui/Dockerfile b/ui/Dockerfile
index 621e3ee..c574d58 100644
--- a/ui/Dockerfile
+++ b/ui/Dockerfile
@@ -1,5 +1,5 @@
 # Node major comes from ui/.node-version (CI checks they agree).
-FROM node:24-alpine@sha256:44fce696f38ba8c987c4db89954051000bbd05ffd8d8659ba15ed4a8602e937f AS builder
+FROM node:24-alpine@sha256:8a32c8cf649a49915a66e81e7a609223c708d0adabf288ee3f4077d765542f85 AS builder
 
 WORKDIR /app
 COPY package*.json ./
@@ -8,7 +8,7 @@ RUN npm ci
 COPY ./ ./
 RUN npm run build
 
-FROM nginx:1.31-alpine@sha256:892bb2152464f0c5d8972593a5f5afaf8054552580b699d95f8ff4af08c2d33d
+FROM nginx:1.31-alpine@sha256:785835ea65db4bba6f021acc0f3be91b0fef76a53fe41f8588c6698d2aed0606
 
 # envsubst (gettext) renders ${API_URL} into the config at startup; jq powers
 # the entrypoint's optional BRANDING_* overlay (standalone runs only).