diff --git a/core/Dockerfile b/core/Dockerfile
index 03576d7c..ca158fde 100644
--- a/core/Dockerfile
+++ b/core/Dockerfile
@@ -300,6 +300,12 @@ RUN apt-get autoremove -y && apt-get clean -y && rm -rf /var/lib/apt/lists/*
 # shipped in everything we publish. A bind mount is never committed to a layer.
 RUN --mount=type=bind,from=python-build,source=/wheels,target=/wheels \
     pip install --no-cache-dir /wheels/*.whl
+
+# Installation is complete. Keep pip and its vendored dependencies out of the
+# runtime, including the bundled wheel that could reinstall them via ensurepip.
+RUN python -m pip uninstall --yes pip && \
+    python -c 'import pathlib, shutil, sysconfig; shutil.rmtree(pathlib.Path(sysconfig.get_path("stdlib")) / "ensurepip")'
+
 # PHP: install prebuilt libraries, then install the app's PHP deps
 COPY --from=php-build /pecl_libs.tar.gz /
 RUN tar -xzf /pecl_libs.tar.gz && rm /pecl_libs.tar.gz
diff --git a/guard/Dockerfile b/guard/Dockerfile
index 128fec2e..eb354d01 100644
--- a/guard/Dockerfile
+++ b/guard/Dockerfile
@@ -41,6 +41,11 @@ EOF
     RUN --mount=type=bind,from=python-build,source=/wheels,target=/wheels \
         pip install --no-cache-dir /wheels/*.whl
 
+    # Installation is complete. Keep pip and its vendored dependencies out of the
+    # runtime, including the bundled wheel that could reinstall them via ensurepip.
+    RUN python -m pip uninstall --yes pip && \
+        python -c 'import pathlib, shutil, sysconfig; shutil.rmtree(pathlib.Path(sysconfig.get_path("stdlib")) / "ensurepip")'
+
     COPY --from=python-build /srv /srv
     COPY files/ /
 
diff --git a/modules/Dockerfile b/modules/Dockerfile
index 1a38a39c..1ef2374f 100644
--- a/modules/Dockerfile
+++ b/modules/Dockerfile
@@ -83,6 +83,11 @@ RUN groupadd -g "${MISP_GID}" misp && \
 RUN --mount=type=bind,from=python-build,source=/wheels,target=/wheels \
     pip install --no-cache-dir /wheels/*.whl
 
+# Installation is complete. Keep pip and its vendored dependencies out of the
+# runtime, including the bundled wheel that could reinstall them via ensurepip.
+RUN python -m pip uninstall --yes pip && \
+    python -c 'import pathlib, shutil, sysconfig; shutil.rmtree(pathlib.Path(sysconfig.get_path("stdlib")) / "ensurepip")'
+
 RUN bash -c 'mkdir -p /custom/{action_mod,expansion,export_mod,import_mod} && chown -R misp:misp /custom'
 
 USER misp