diff --git a/.node-version b/.node-version
index 8a94b991..63f87c20 100644
--- a/.node-version
+++ b/.node-version
@@ -1 +1 @@
-26.10.0
+26.12.1
diff --git a/Dockerfile b/Dockerfile
index 16d029c8..774456df 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,6 +4,7 @@ ARG GO_VERSION=1.27.3
 ARG ALPINE_VERSION=3.24
 
 FROM golang:${GO_VERSION}-alpine AS build
+RUN apk add --no-cache --upgrade ca-certificates=20261020-r0 ca-certificates-bundle=20261020-r0
 RUN apk add --no-cache ca-certificates git
 WORKDIR /src
 COPY go.mod go.sum ./
@@ -15,6 +16,7 @@ RUN CGO_ENABLED=0 GOEXPERIMENT=simd GOOS=linux go build -trimpath \
     -o /out/gitcrawl ./cmd/gitcrawl
 
 FROM alpine:${ALPINE_VERSION}
+RUN apk add --no-cache --upgrade ca-certificates=20261020-r0 ca-certificates-bundle=20261020-r0
 RUN apk add --no-cache ca-certificates git openssh-client tzdata \
     && adduser -D -u 10001 -h /home/gitcrawl gitcrawl \
     && mkdir -p /data/config /data/data /data/cache /data/state \
diff --git a/README.md b/README.md
index 1b58487c..1edda515 100644
--- a/README.md
+++ b/README.md
@@ -83,7 +83,7 @@ make test
 make check
 ```
 
-`make check` runs the formatting, vet, vulnerability, dead-code, coverage, smoke, release-script, documentation, and snapshot gates used by CI. The documentation build uses Node.js 26.10.0 (pinned in `.node-version`); `make docs` runs that gate alone. CI pins GoReleaser v2.18.2 for snapshot builds.
+`make check` runs the formatting, vet, vulnerability, dead-code, coverage, smoke, release-script, documentation, and snapshot gates used by CI. The documentation build uses Node.js 26.12.1 (pinned in `.node-version`); `make docs` runs that gate alone. CI pins GoReleaser v2.18.2 for snapshot builds.
 
 macOS CI runs on the Apple Silicon `xcode-27` image with an explicit macOS 13.0 deployment target. Release verification executes Intel binaries under Rosetta, installing it if needed, and rejects binaries that raise the macOS 13 minimum.