diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c4a2fe1..89f5a96 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -78,6 +78,6 @@ jobs:
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
-          file: Dockerfile.build
+          file: Dockerfile
           platforms: linux/amd64
           push: false
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 7ceb564..7466912 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -49,7 +49,7 @@ jobs:
         uses: step-security/docker-build-push-action@v7
         with:
           context: .
-          file: Dockerfile.build
+          file: Dockerfile
           push: true
           platforms: linux/amd64,linux/arm64
           tags: |
diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 0000000..34cf5e7
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,12 @@
+# msgpack and setuptools are vendored INSIDE pip's own bundled wheel at
+# ensurepip/_bundled/pip-*.whl and are not exposed to user code or the
+# coverage_comment application. They cannot be upgraded via pip install.
+
+# msgpack: out-of-bounds read on Unpacker reuse
+GHSA-6v7p-g79w-8964
+
+# setuptools: path traversal in PackageIndex
+CVE-2025-47273
+
+# setuptools: MANIFEST.in exclusion bypass
+CVE-2026-59890
diff --git a/Dockerfile b/Dockerfile
index 25fdf59..22fc006 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,21 @@
-# See Dockerfile.build for instructions on bumping this.
-FROM ghcr.io/py-cov-action/python-coverage-comment-action-base:v7@sha256:b9e711e0233b04cd64a35d10fe4fb2f825a6a4f1faa399097aefd667704b8d2e
+FROM python:3.14-alpine@sha256:05b2b8b732ecd268fee8727a369f936f022d1321b59befd13c30ede22769dcdc
+
+RUN apk upgrade --no-cache && \
+    apk add --no-cache git-lfs
+
+# https://github.com/actions/runner-images/issues/6775
+RUN git config --system --add safe.directory '*'
+
+WORKDIR /workdir
+
+COPY pyproject.toml LICENSE ./
+RUN md5sum pyproject.toml > pyproject.toml.md5
 
 COPY coverage_comment ./coverage_comment
-RUN md5sum -c pyproject.toml.md5 || pip install -e .
+ENV PIP_DISABLE_PIP_VERSION_CHECK=1
+ENV PIP_ROOT_USER_ACTION=ignore
+ENV PIP_NO_CACHE_DIR=off
+
+RUN pip install -e .
+
+CMD [ "coverage_comment" ]
diff --git a/Dockerfile.build b/Dockerfile.build
index b3163d6..22fc006 100644
--- a/Dockerfile.build
+++ b/Dockerfile.build
@@ -1,13 +1,7 @@
-# If you change anything here, bump the version in:
-# - Dockerfile
-# - .github/workflows/ci.yml (the image tags of the push-to-registry job)
+FROM python:3.14-alpine@sha256:05b2b8b732ecd268fee8727a369f936f022d1321b59befd13c30ede22769dcdc
 
-FROM python:3.14-slim
-
-RUN set -eux; \
-    apt-get update; \
-    apt-get install -y git-lfs; \
-    rm -rf /var/lib/apt/lists/*
+RUN apk upgrade --no-cache && \
+    apk add --no-cache git-lfs
 
 # https://github.com/actions/runner-images/issues/6775
 RUN git config --system --add safe.directory '*'
diff --git a/action.yml b/action.yml
index 4e46e88..592bad1 100644
--- a/action.yml
+++ b/action.yml
@@ -173,7 +173,7 @@ outputs:
     description: The number of changed lines in the diff. (Only available in PR mode)
 runs:
   using: docker
-  image: Dockerfile.build
+  image: Dockerfile
   env:
     ACTIVITY: ${{ inputs.ACTIVITY }}
     GITHUB_BASE_URL: ${{ inputs.GITHUB_BASE_URL }}