diff --git a/src/codeprobe/sandbox/Dockerfile.agent b/src/codeprobe/sandbox/Dockerfile.agent
index 9e918434..f81b1594 100644
--- a/src/codeprobe/sandbox/Dockerfile.agent
+++ b/src/codeprobe/sandbox/Dockerfile.agent
@@ -8,7 +8,7 @@
 # run with --network=bridge: the agent must reach the model API. Only the
 # slot worktree and the session CLAUDE_CONFIG_DIR are mounted rw; the rest
 # of the container filesystem is throwaway.
-FROM node:22-bookworm-slim@sha256:6c74791e557ce11fc957704f6d4fe134a7bc8d6f5ca4403205b2966bd488f6b3
+FROM node:22-bookworm-slim@sha256:c3de60bf2f9dd0ac6370e6117950ff62d6e339527e7472301c9c78a017978392
 
 ARG DEBIAN_SNAPSHOT=20260728T000000Z
 ARG CLAUDE_CODE_VERSION=2.1.220