diff --git a/.changeset/patch-base-image-os-packages.md b/.changeset/patch-base-image-os-packages.md
new file mode 100644
index 00000000000..680bc13395f
--- /dev/null
+++ b/.changeset/patch-base-image-os-packages.md
@@ -0,0 +1,5 @@
+---
+'hive': patch
+---
+
+Apply OS security updates to the base image at build time by adding `apt-get upgrade` to the service, migrations, and CLI Dockerfiles. Previously these only ran `apt-get update` followed by `apt-get install` of a few specific packages, so Debian security patches inherited from the pinned `node:*-slim` base were never applied — leaving published images with known-fixed CVEs. Bumping the base image tag alone does not fix this, since the latest `node` tag can still lag behind Debian's security updates.
\ No newline at end of file
diff --git a/docker/cli.dockerfile b/docker/cli.dockerfile
index 78c9ba0166e..c26e1dcd329 100644
--- a/docker/cli.dockerfile
+++ b/docker/cli.dockerfile
@@ -1,6 +1,6 @@
 FROM node:24.14.1-slim
 
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates git && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get upgrade -y --no-install-recommends && apt-get install -y --no-install-recommends ca-certificates git && rm -rf /var/lib/apt/lists/*
 
 ARG CLI_VERSION
 
diff --git a/docker/migrations.dockerfile b/docker/migrations.dockerfile
index 110cfd3c277..15dd2611d4a 100644
--- a/docker/migrations.dockerfile
+++ b/docker/migrations.dockerfile
@@ -1,6 +1,6 @@
 FROM node:24.14.1-slim
 
-RUN apt-get update && apt-get install -y ca-certificates
+RUN apt-get update && apt-get upgrade -y --no-install-recommends && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /usr/src/app
 
diff --git a/docker/services.dockerfile b/docker/services.dockerfile
index 0f8689c0b5b..fb90b2159f4 100644
--- a/docker/services.dockerfile
+++ b/docker/services.dockerfile
@@ -1,6 +1,6 @@
 FROM node:24.14.1-slim
 
-RUN apt-get update && apt-get install -y wget ca-certificates && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get upgrade -y --no-install-recommends && apt-get install -y --no-install-recommends wget ca-certificates && rm -rf /var/lib/apt/lists/*
 
 ARG SERVICE_DIR_NAME
 WORKDIR /usr/src/app/$SERVICE_DIR_NAME