diff --git a/docker/Dockerfile b/docker/Dockerfile
index 4f9ca06..cdb2810 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,9 +1,10 @@
-FROM node:24-slim AS base
+FROM node:24.22.1-trixie-slim AS base
 WORKDIR /app
 
 # Build toolchain + CLI-install prereqs. curl is needed for the opencode
 # installer; git + python3 + make + g++ are for native addon compiles.
 RUN apt-get update \
+  && apt-get upgrade -y \
   && apt-get install -y --no-install-recommends \
        python3 make g++ curl git ca-certificates unzip xz-utils \
   && rm -rf /var/lib/apt/lists/*
@@ -34,10 +35,8 @@ RUN curl -fsSL https://opencode.ai/install | bash \
 # install with an absolute path. Symlink both into /usr/local/bin so
 # they're on PATH at runtime AND survive the /root/.kimi volume mount
 # (which only covers auth state).
-RUN curl -LsSf https://astral.sh/uv/install.sh | sh \
-  && /root/.local/bin/uv tool install --python 3.13 kimi-cli \
-  && ln -sf /root/.local/bin/kimi /usr/local/bin/kimi \
-  && ln -sf /root/.local/bin/uv /usr/local/bin/uv
+COPY scripts/install-harness.sh scripts/python-security-overrides.txt /usr/local/share/cli-bridge/
+RUN sh /usr/local/share/cli-bridge/install-harness.sh kimi
 
 # Factory droid, Sourcegraph amp, Forge left out by default — install
 # manually on hosts that need them. They change rapidly.
@@ -50,6 +49,9 @@ RUN corepack enable && corepack prepare pnpm@12.6.0 --activate \
 COPY . .
 RUN pnpm typecheck
 
+# Native addons are built; keep only the runtime libraries in the serving image.
+RUN apt-get purge -y --auto-remove make g++
+
 ENV BRIDGE_HOST=0.0.0.0
 ENV BRIDGE_PORT=3344
 ENV BRIDGE_DATA_DIR=/data
diff --git a/docker/Dockerfile.cli-runtime b/docker/Dockerfile.cli-runtime
index 7a52df8..7415c0d 100644
--- a/docker/Dockerfile.cli-runtime
+++ b/docker/Dockerfile.cli-runtime
@@ -31,7 +31,7 @@
 # The bridge's container-pool config bind-mounts only the dirs the
 # active backend needs.
 
-FROM node:24-slim
+FROM node:24.22.1-trixie-slim
 
 ARG CLI_BRIDGE_HARNESSES=all
 
@@ -42,6 +42,7 @@ ARG CLI_BRIDGE_HARNESSES=all
 # a net-jailed backend refuses to start rather than run a jail that does not
 # deny, so this package is a hard requirement of that mode, not an extra.
 RUN apt-get update \
+  && apt-get upgrade -y \
   && apt-get install -y --no-install-recommends \
        git ca-certificates dumb-init curl python3 iptables \
   && rm -rf /var/lib/apt/lists/*
@@ -49,7 +50,7 @@ RUN apt-get update \
 # --- CLI installs (Pi is pinned to its qualified RPC version) ---
 # Source of truth lives in scripts/install-harness.sh so host installs,
 # subset images, and the all-in-one runtime cannot drift.
-COPY scripts/install-harness.sh /usr/local/share/cli-bridge/install-harness.sh
+COPY scripts/install-harness.sh scripts/python-security-overrides.txt /usr/local/share/cli-bridge/
 RUN set -eu; \
   if [ "$CLI_BRIDGE_HARNESSES" = "all" ]; then \
     sh /usr/local/share/cli-bridge/install-harness.sh all; \
diff --git a/scripts/install-harness.sh b/scripts/install-harness.sh
index 67615e0..32461f3 100755
--- a/scripts/install-harness.sh
+++ b/scripts/install-harness.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env sh
 set -eu
 
+harness_script_dir="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
 harness="${1:-}"
 if [ -z "$harness" ]; then
   echo "usage: scripts/install-harness.sh <claude|codex|opencode|kimi|gemini|pi|prime|all>" >&2
@@ -37,7 +38,7 @@ install_kimi() {
     echo "uv install did not produce a uv binary on PATH or ~/.local/bin" >&2
     exit 1
   fi
-  "$uv_bin" tool install --python 3.13 kimi-cli
+  "$uv_bin" tool install --python 3.13 --overrides "$harness_script_dir/python-security-overrides.txt" kimi-cli
   if [ -x "${HOME:-/root}/.local/bin/kimi" ]; then
     mkdir -p /usr/local/bin 2>/dev/null || true
     ln -sf "${HOME:-/root}/.local/bin/kimi" /usr/local/bin/kimi 2>/dev/null || true
diff --git a/scripts/python-security-overrides.txt b/scripts/python-security-overrides.txt
new file mode 100644
index 0000000..a3376a3
--- /dev/null
+++ b/scripts/python-security-overrides.txt
@@ -0,0 +1,2 @@
+# Kimi pins an older Pillow; this image owns the audited security override.
+pillow==13.0.0