diff --git a/Dockerfile b/Dockerfile
index bf123fa..d7094d1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,6 +14,9 @@ RUN bun run build
 # Production stage
 FROM nginx:alpine AS production
 
+# Patch inherited Alpine OS packages to clear known CVEs not yet in the base image
+RUN apk upgrade --no-cache
+
 COPY --from=builder /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf