diff --git a/Dockerfile b/Dockerfile
index 1df698e..137fe59 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,7 +26,8 @@ COPY public ./public
 RUN npm run build
 
 # ─── Stage 3: Runtime (FrankenPHP + PHP 8.4) ──────────────────
-FROM dunglas/frankenphp:1-php8.4 AS runtime
+# Pinned to 1.13.4-php8.4.27 — fixes PHP2Shell RCE (CVE-2026-109618, CVE-2026-109619)
+FROM dunglas/frankenphp:1.13.4-php8.4.27 AS runtime
 WORKDIR /app
 
 # Install PHP extensions Laravel needs