diff --git a/CHANGELOG.md b/CHANGELOG.md
index a87181d..2d2e6c6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,11 @@ a decision with visible consequences.
 
 ## Unreleased
 
+## 0.8.1
+
+- **The image takes Debian's security fixes newer than its base** (apt, CVE-2026-109518).
+  No code change.
+
 ## 0.8.0
 
 - **Refused request bodies are never echoed back.** A 422 lists only `loc`, `msg` and `type` for
diff --git a/services/api/Dockerfile b/services/api/Dockerfile
index 5986a58..48cf168 100644
--- a/services/api/Dockerfile
+++ b/services/api/Dockerfile
@@ -1,6 +1,10 @@
 FROM python:3.11-slim
 WORKDIR /app
 ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
+# Debian security fixes newer than the base image.
+RUN apt-get update \
+    && apt-get upgrade -y --no-install-recommends \
+    && rm -rf /var/lib/apt/lists/*
 COPY requirements.txt .
 # The base image's setuptools and wheel are build tools the service never imports; removing
 # them keeps their vendored copies (and their advisories) out of the running image.
diff --git a/services/api/app/main.py b/services/api/app/main.py
index 75d2b56..2719f97 100644
--- a/services/api/app/main.py
+++ b/services/api/app/main.py
@@ -47,7 +47,7 @@
 
 log = logging.getLogger("memorygate")
 
-SERVICE_VERSION = "0.8.0"
+SERVICE_VERSION = "0.8.1"
 
 app = FastAPI(title="MemoryGate", version=SERVICE_VERSION)