diff --git a/.docker/nginx/Dockerfile b/.docker/nginx/Dockerfile
index 0aa68c2..934d5d6 100644
--- a/.docker/nginx/Dockerfile
+++ b/.docker/nginx/Dockerfile
@@ -1,6 +1,10 @@
 ARG NGINX_CONF=http
 # Pin the exact Nginx version and multi-platform digest for traceable Dependabot updates.
-FROM nginx:1.31.7-alpine3.24@sha256:892bb2152464f0c5d8972593a5f5afaf8054552580b699d95f8ff4af08c2d33d
+FROM nginx:1.31.8-alpine3.24@sha256:785835ea65db4bba6f021acc0f3be91b0fef76a53fe41f8588c6698d2aed0606
+# The pinned upstream image still contains brotli-libs 1.2.0-r1 (CVE-2026-111497).
+# Apply Alpine's fixed package without disabling vulnerability scanning.
+RUN apk upgrade --no-cache brotli-libs
+
 ARG NGINX_CONF
 ENV NGINX_PORT=80
 
diff --git a/.docker/php/Dockerfile b/.docker/php/Dockerfile
index 353c154..ab56896 100644
--- a/.docker/php/Dockerfile
+++ b/.docker/php/Dockerfile
@@ -4,11 +4,11 @@ FROM node:20.20.2-bookworm-slim@sha256:2cf067cfed83d5ea958367df9f966191a942351a2
 FROM mlocati/php-extension-installer:2.12.0 AS php-extension-installer
 FROM php:8.3.36-fpm-trixie@sha256:7c6bba25ec696f21a2e3ca0b7d3e4282c899095e7e628c1851b0432f14a49d76 AS runtime
 
-
-
+# Refresh kernel headers from Debian security fixes for CVE-2026-99083.
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         git \
+        linux-libc-dev \
         rsync \
         unzip \
     && rm -rf /var/lib/apt/lists/*