diff --git a/Dockerfile.duckdb b/Dockerfile.duckdb
index ba36972..5065e44 100644
--- a/Dockerfile.duckdb
+++ b/Dockerfile.duckdb
@@ -1,4 +1,4 @@
-FROM python:3.14.2-slim
+FROM python:3.14.8-slim
 # One dual-role image per engine: the python-node runtime harness (default
 # command `run`) and the blue/green validation runner (`validation-op`). It
 # installs the PUBLISHED, versioned libraries, never the repo source:
diff --git a/Dockerfile.postgres b/Dockerfile.postgres
index 4635336..ab7d8e6 100644
--- a/Dockerfile.postgres
+++ b/Dockerfile.postgres
@@ -1,4 +1,4 @@
-FROM python:3.14.2-slim
+FROM python:3.14.8-slim
 # One dual-role image per engine — the python-node runtime harness (default
 # command `run`) and the blue/green validation runner (`validation-op`). It
 # installs the PUBLISHED, versioned libraries, never the repo source:
diff --git a/Dockerfile.trino b/Dockerfile.trino
index 4443ede..9c7866d 100644
--- a/Dockerfile.trino
+++ b/Dockerfile.trino
@@ -1,4 +1,4 @@
-FROM python:3.14.2-slim
+FROM python:3.14.8-slim
 # One dual-role image per engine — the python-node runtime harness (default
 # command `run`) and the blue/green validation runner (`validation-op`). It
 # installs the PUBLISHED, versioned libraries, never the repo source: