diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d1df17a..1a1e6a5 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -23,3 +23,16 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 1
+    ignore:
+      # Track the Node LTS line only. Odd-numbered Node majors are "Current"
+      # releases with a ~7-month support window; Dependabot happily proposes
+      # them and has already offered one that was ALREADY end-of-life (PR #72
+      # proposed node:25-alpine on 2026-08-17; Node 25 reached EOL 2026-06-01
+      # per https://github.com/nodejs/Release/blob/main/schedule.json).
+      #
+      # Pinning the published image to an EOL runtime means no upstream
+      # security patches, so ignore majors and bump this deliberately when the
+      # next LTS (v26, Active LTS from 2026-10-28) is cut. Minor/patch digest
+      # refreshes on the pinned major still come through.
+      - dependency-name: "node"
+        update-types: ["version-update:semver-major"]
diff --git a/Dockerfile b/Dockerfile
index 8492e12..a796cbf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS builder
+FROM node:24-alpine@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS builder
 
 WORKDIR /app
 
@@ -22,7 +22,7 @@ RUN case "$SOURCE_COMMIT" in \
     npm prune --omit=dev && \
     npm cache clean --force
 
-FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS runtime
+FROM node:24-alpine@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS runtime
 
 ARG SOURCE_COMMIT
 LABEL org.opencontainers.image.source="https://github.com/OilpriceAPI/mcp-server" \