diff --git a/infra/docker/Dockerfile.api b/infra/docker/Dockerfile.api
index 24f3916..bc8a756 100644
--- a/infra/docker/Dockerfile.api
+++ b/infra/docker/Dockerfile.api
@@ -3,7 +3,7 @@
 # Usuário não-root, sem segredos na imagem (tudo por variável de ambiente).
 # Aplica as migrations no start (idempotente) e sobe o servidor.
 # ─────────────────────────────────────────────────────────────────────────────
-FROM node:22-bookworm-slim AS build
+FROM node:25-bookworm-slim AS build
 WORKDIR /app
 RUN apt-get update && apt-get install -y --no-install-recommends openssl && rm -rf /var/lib/apt/lists/*
 COPY package.json package-lock.json ./
@@ -19,7 +19,7 @@ RUN npm run build -w @subweb/protocol
 COPY apps/api apps/api
 RUN cd apps/api && npx prisma generate && npm run build
 
-FROM node:22-bookworm-slim AS runtime
+FROM node:25-bookworm-slim AS runtime
 ENV NODE_ENV=production API_HOST=0.0.0.0 API_PORT=3460 HOME=/tmp
 WORKDIR /app
 RUN apt-get update && apt-get install -y --no-install-recommends openssl curl && rm -rf /var/lib/apt/lists/*
diff --git a/infra/docker/Dockerfile.controller b/infra/docker/Dockerfile.controller
index abf45ba..c5950da 100644
--- a/infra/docker/Dockerfile.controller
+++ b/infra/docker/Dockerfile.controller
@@ -7,7 +7,7 @@
 # socket do Docker é root — quem tem o socket já é root no host, então o
 # isolamento real é: nenhuma porta exposta, rede interna, HMAC e argumentos fixos.
 # ─────────────────────────────────────────────────────────────────────────────
-FROM node:22-bookworm-slim AS build
+FROM node:25-bookworm-slim AS build
 WORKDIR /app
 COPY package.json package-lock.json ./
 COPY packages/protocol/package.json packages/protocol/package.json
@@ -26,7 +26,7 @@ RUN npm run build -w @subweb/controller \
 
 FROM docker:27.5.1-cli AS dockercli
 
-FROM node:22-bookworm-slim AS runtime
+FROM node:25-bookworm-slim AS runtime
 COPY --from=dockercli /usr/local/bin/docker /usr/local/bin/docker
 ENV NODE_ENV=production CONTROLLER_HOST=0.0.0.0 CONTROLLER_PORT=3470 \
     WORKER_SECCOMP_PROFILE=/app/seccomp-chromium.json WORKER_NETWORK=subweb_workers
diff --git a/infra/docker/Dockerfile.edge b/infra/docker/Dockerfile.edge
index 78a55d4..d8429d3 100644
--- a/infra/docker/Dockerfile.edge
+++ b/infra/docker/Dockerfile.edge
@@ -2,7 +2,7 @@
 # SubWebNavigator · Borda da rede dos workers: proxy de egress e relay.
 # A mesma imagem roda os dois serviços (comandos diferentes no compose).
 # ─────────────────────────────────────────────────────────────────────────────
-FROM node:22-bookworm-slim AS build
+FROM node:25-bookworm-slim AS build
 WORKDIR /app
 COPY package.json package-lock.json ./
 COPY packages/protocol/package.json packages/protocol/package.json
@@ -19,7 +19,7 @@ RUN npm run build -w @subweb/edge \
   && cp -r node_modules/ws node_modules/ipaddr.js /out/node_modules/ \
   && cp -r apps/edge/dist /out/dist
 
-FROM node:22-bookworm-slim AS runtime
+FROM node:25-bookworm-slim AS runtime
 ENV NODE_ENV=production
 WORKDIR /app
 COPY --from=build /out/ /app/
diff --git a/infra/docker/Dockerfile.web b/infra/docker/Dockerfile.web
index 4db20fc..d6ed1ce 100644
--- a/infra/docker/Dockerfile.web
+++ b/infra/docker/Dockerfile.web
@@ -1,7 +1,7 @@
 # ─────────────────────────────────────────────────────────────────────────────
 # SubWebNavigator · Web (Vite → nginx). Build context: raiz do monorepo.
 # ─────────────────────────────────────────────────────────────────────────────
-FROM node:22-bookworm-slim AS build
+FROM node:25-bookworm-slim AS build
 WORKDIR /app
 COPY package.json package-lock.json ./
 COPY packages/protocol/package.json packages/protocol/package.json
diff --git a/infra/docker/Dockerfile.worker b/infra/docker/Dockerfile.worker
index 96c5933..69f2923 100644
--- a/infra/docker/Dockerfile.worker
+++ b/infra/docker/Dockerfile.worker
@@ -4,7 +4,7 @@
 # Roda como UID 1000, rootfs somente leitura, sandbox do Chromium LIGADO.
 # Build context: raiz do monorepo.
 # ─────────────────────────────────────────────────────────────────────────────
-FROM node:22-bookworm-slim AS build
+FROM node:25-bookworm-slim AS build
 WORKDIR /app
 COPY package.json package-lock.json ./
 COPY packages/protocol/package.json packages/protocol/package.json
@@ -24,7 +24,7 @@ RUN npm run build -w @subweb/protocol && npm run build -w @subweb/worker \
   && cp -r packages/protocol/package.json packages/protocol/dist /out/node_modules/@subweb/protocol/ \
   && cp -r apps/worker/dist /out/dist
 
-FROM node:22-bookworm-slim AS runtime
+FROM node:25-bookworm-slim AS runtime
 LABEL swn.image=worker
 RUN apt-get update \
   && apt-get install -y --no-install-recommends chromium xvfb dumb-init ca-certificates \