diff --git a/Containerfile b/Containerfile
index acc65a2..2e9d9d8 100644
--- a/Containerfile
+++ b/Containerfile
@@ -36,11 +36,16 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     PATH=/opt/venv/bin:$PATH
 
-# libuuid is patched explicitly rather than left to the base's pinned version:
-# the pinned Alpine 3.24.1 ships 2.42.1-r0, which carries every remaining HIGH
-# finding, all fixed in 2.42.3. The floor is a minimum version, not a floating
-# upgrade, so the build stays reproducible while refusing a vulnerable libuuid.
-RUN apk add --no-cache 'libuuid>=2.42.3-r1' \
+# Packages are patched explicitly rather than left to the base's pinned
+# versions. The pinned Alpine 3.24.1 ships libuuid 2.42.1-r0 (fixed in
+# 2.42.3), musl 1.2.6-r2 (CVE-2026-107891, fixed in 1.2.6-r3) and zlib
+# 1.3.2-r0 (CVE-2026-85091, fixed in 1.3.2-r1). Each floor is a minimum
+# version, not a floating upgrade.
+RUN apk add --no-cache \
+        'libuuid>=2.42.3-r1' \
+        'musl>=1.2.6-r3' \
+        'musl-utils>=1.2.6-r3' \
+        'zlib>=1.3.2-r1' \
     && addgroup -S -g 10001 approval \
     && adduser -S -u 10001 -G approval -H approval \
     && rm -rf /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.12 \