diff --git a/Dockerfile b/Dockerfile
index ad3a79a2b6..93862fe0b9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -144,6 +144,9 @@ ARG KUBECTL_VERSION=1.37.1
 ARG HELM_VERSION=3.21.4
 # NOTE: If changing, also change go version in workspace dependencies template at WorkspaceDependenciesEditor.svelte
 ARG GO_VERSION=1.27.1
+# Pinned to the patch: an unpinned install is cached by the image build and stops picking up
+# security releases.
+ARG NODE_VERSION=24.22.1
 ARG APP=/usr/src/app
 ARG WITH_POWERSHELL=true
 ARG WITH_KUBECTL=true
@@ -252,8 +255,8 @@ RUN UV_CACHE_DIR=/tmp/build_cache/uv UV_PYTHON_INSTALL_DIR=/tmp/build_cache/py_r
 RUN UV_CACHE_DIR=/tmp/build_cache/uv UV_PYTHON_INSTALL_DIR=/tmp/build_cache/py_runtime uv python install $NEW_INSTANCE_PY --compile-bytecode
 
 
-RUN curl -sL https://deb.nodesource.com/setup_24.x | bash -
-RUN apt-get -y update && apt-get install -y --no-install-recommends curl procps nodejs awscli && apt-get clean \
+RUN curl -sL https://deb.nodesource.com/setup_${NODE_VERSION%%.*}.x | bash -
+RUN apt-get -y update && apt-get install -y --no-install-recommends curl procps nodejs=${NODE_VERSION}-1nodesource1 awscli && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
 # The npm bundled with nodejs is replaced by a pinned one: it is what `//npm` scripts install with