diff --git a/Dockerfile.dev b/Dockerfile.dev
index 156479fc..3ad9e298 100644
--- a/Dockerfile.dev
+++ b/Dockerfile.dev
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.27@sha256:bde3983e9c939224420ddaf6b784cc30e09b035a4dea01f581230c50809f372e
+# syntax=docker/dockerfile:1.28@sha256:bb22d9815c728170f72750f4e5b0d672e06176142e1d602c7e66c050100b7e5b
 # Toolchain only: the source is bind-mounted at runtime (compose.dev.yaml),
 # node_modules and pnpm's home live in volumes, so the host needs no node.
 FROM node:24.20.0-trixie-slim@sha256:50c3b2f6988dfc307b86e5301d69611af31f4789bdf232863b07d3b02fe55ae0
diff --git a/Dockerfile.prod b/Dockerfile.prod
index 88af1975..e98156bb 100644
--- a/Dockerfile.prod
+++ b/Dockerfile.prod
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.27@sha256:bde3983e9c939224420ddaf6b784cc30e09b035a4dea01f581230c50809f372e
+# syntax=docker/dockerfile:1.28@sha256:bb22d9815c728170f72750f4e5b0d672e06176142e1d602c7e66c050100b7e5b
 ARG CAESAR_BUILD_VERSION
 
 # trixie = Debian 13, same glibc as the cc-debian13 runtime below. mediasoup's
diff --git a/compose.prod-dev.yaml b/compose.prod-dev.yaml
index 3d13b395..1b5fd2ff 100644
--- a/compose.prod-dev.yaml
+++ b/compose.prod-dev.yaml
@@ -34,7 +34,7 @@ services:
       - ./config.ini:/home/node/.config/caesar/config.ini:ro
 
   caddy:
-    image: docker.io/library/caddy:2-alpine@sha256:5f5c8640aae01df9654968d946d8f1a56c497f1dd5c5cda4cf95ab7c14d58648
+    image: docker.io/library/caddy:2-alpine@sha256:d8542f48d34a9cf4e4c11a478865229840e87e4c96ea3f439101f31a5d35f75f
     container_name: caesar-caddy-prod-dev
     restart: "no"
     depends_on:
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 3d594674..d5f820f2 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -42,7 +42,7 @@ services:
   # `caddy reverse-proxy` instead of a Caddyfile so this file alone is enough
   # (podman-compose ignores top-level configs).
   caddy:
-    image: docker.io/library/caddy:2-alpine@sha256:5f5c8640aae01df9654968d946d8f1a56c497f1dd5c5cda4cf95ab7c14d58648
+    image: docker.io/library/caddy:2-alpine@sha256:d8542f48d34a9cf4e4c11a478865229840e87e4c96ea3f439101f31a5d35f75f
     container_name: caesar-caddy
     restart: unless-stopped
     depends_on: