diff --git a/Dockerfile b/Dockerfile
index 72d1cd9..9e338c3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -93,5 +93,17 @@ RUN apk add --no-cache \
       font-noto \
       postgresql-client
 
+# CVE-2026-111497 (brotli decoder out-of-bounds write, CISA KEV, due 2026-11-10): the
+# forgejo/runner:12.11.1 base ships brotli-libs 1.2.0-r0, and `apk add` above never
+# upgrades a package the base already has. git-remote-http and curl link it through
+# libcurl. Upgrade it explicitly and fail the build if it is still behind, so a base
+# bump can never quietly bring the vulnerable version back. Drop this once the upstream
+# runner base ships brotli-libs >= 1.2.1.
+RUN set -eux; \
+    apk upgrade --no-cache brotli-libs; \
+    v="$(apk list --installed brotli-libs | sed -n 's/^brotli-libs-\([0-9][^ ]*\) .*/\1/p')"; \
+    echo "brotli-libs ${v}"; \
+    [ "$(apk version -t "${v}" 1.2.1-r0)" != "<" ] || { echo "brotli-libs ${v} is older than 1.2.1-r0 (CVE-2026-111497)"; exit 1; }
+
 # Match the runner pod's runAsUser (1000); keep the image non-root by default.
 USER 1000