diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index eb71aa07..febfe021 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -97,6 +97,16 @@ updates:
       prefix: chore(deps)
     labels:
       - type/chore
+    # A new Go minor (1.26 -> 1.27) is a toolchain move, not a routine image
+    # bump: go.mod, go.work, ci.yml's GO_VERSION and these three Dockerfiles
+    # move together, so the image is built on the Go that CI tests. #1470 moved
+    # only the images, to golang 1.27.2, which also carried GO-2026-6809
+    # (fixed in 1.26.10 and 1.27.3) and failed the shipped-image scan. Go
+    # patch releases (1.26.x) still arrive through the group below.
+    ignore:
+      - dependency-name: golang
+        update-types:
+          - version-update:semver-minor
     groups:
       docker-minor-patch:
         update-types:
diff --git a/Dockerfile b/Dockerfile
index 9c3e4280..195a3e3f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -128,10 +128,10 @@ RUN npm run build
 # Runtime stage - multi-arch base image
 # ==============================================
 # Image pinned to a SHA256 digest for reproducible builds.
-# To refresh: `docker buildx imagetools inspect alpine:3.24.1` and update the
+# To refresh: `docker buildx imagetools inspect alpine:3.24.2` and update the
 # digest below. This is the multi-arch index digest, not a per-platform one, so
 # it stays correct for every TARGETARCH this image is built for.
-FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
+FROM alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
 
 # Re-declare args for use in this stage
 ARG TARGETARCH