diff --git a/src/codeprobe/sandbox/Dockerfile.agent b/src/codeprobe/sandbox/Dockerfile.agent
index 9e91843..f700b25 100644
--- a/src/codeprobe/sandbox/Dockerfile.agent
+++ b/src/codeprobe/sandbox/Dockerfile.agent
@@ -8,7 +8,7 @@
 # run with --network=bridge: the agent must reach the model API. Only the
 # slot worktree and the session CLAUDE_CONFIG_DIR are mounted rw; the rest
 # of the container filesystem is throwaway.
-FROM node:22-bookworm-slim@sha256:6c74791e557ce11fc957704f6d4fe134a7bc8d6f5ca4403205b2966bd488f6b3
+FROM node:22-bookworm-slim@sha256:83f487e0a63425e5b4d146fb5e5be574bcbe1b7b843d3ebafdd95eaf7767a7e5
 
 ARG DEBIAN_SNAPSHOT=20260728T000000Z
 ARG CLAUDE_CODE_VERSION=2.1.220