diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile
index d59b6107c..b8188403c 100644
--- a/apps/api/Dockerfile
+++ b/apps/api/Dockerfile
@@ -145,9 +145,16 @@ WORKDIR /app
 # socket became reachable.
 # The pinned base predates Alpine's OpenSSL fix for CVE-2026-14456, and git
 # pulls in libexpat, whose CVE-2026-66046 fix landed after this base was cut.
-# curl pulls in brotli-libs; 1.2.1-r0 fixes CVE-2026-111497.
+# curl pulls in brotli-libs; 1.2.1-r0 fixes CVE-2026-111497. curl and libcurl
+# 8.23.0-r0 fix CVE-2026-92392. `apk add` alone is not enough: a release build
+# can restore this layer from the registry build cache with the curl it held
+# then. Naming curl here, and the version floor checked after, change this
+# instruction, which keeps such a layer from being reused; the floor also
+# fails the build on a mirror that doesn't have the fix yet.
 RUN apk add --no-cache curl ca-certificates git && \
-    apk upgrade --no-cache libcrypto3 libssl3 libexpat brotli-libs && \
+    apk upgrade --no-cache libcrypto3 libssl3 libexpat brotli-libs curl libcurl && \
+    libcurl="$(apk query --fields version libcurl)" && libcurl="${libcurl#Version: }" && \
+    test -n "$libcurl" && test "$(apk version -t "$libcurl" 8.23.0-r0)" != "<" && \
     rm -rf /usr/local/lib/node_modules/npm && \
     rm -f /usr/local/bin/npm /usr/local/bin/npx
 
diff --git a/apps/ops-agent/Dockerfile b/apps/ops-agent/Dockerfile
index c3efb8623..4e231c0af 100644
--- a/apps/ops-agent/Dockerfile
+++ b/apps/ops-agent/Dockerfile
@@ -90,10 +90,19 @@ RUN node scripts/copy-runtime-packages.mjs /tmp/runtime-packages.json /app /runt
 # dependencies, out of the shipped image.
 FROM node:24.22.1-alpine@sha256:6a1c190e17215d844926b0677f4bf87273ff7d5e54db06d3b5b5863ab0b09a3d AS runner
 WORKDIR /app
-# The pinned base predates Alpine's OpenSSL fix for CVE-2026-14456.
+# The pinned base predates Alpine's OpenSSL fix for CVE-2026-14456. curl and
+# libcurl 8.23.0-r0 fix CVE-2026-92392.
 # git fetches community service repositories into the agent's community store.
-RUN apk upgrade --no-cache libcrypto3 libssl3 && \
-    apk add --no-cache ca-certificates curl docker-cli docker-cli-compose git tini && \
+# The upgrade runs after the install: `apk upgrade` of a package that isn't
+# installed yet does nothing. `apk add` alone is not enough: a release build can
+# restore this layer from the registry build cache with the curl it held then.
+# Naming curl in the upgrade, and the version floor checked after, change this
+# instruction, which keeps such a layer from being reused; the floor also fails
+# the build on a mirror that doesn't have the fix yet.
+RUN apk add --no-cache ca-certificates curl docker-cli docker-cli-compose git tini && \
+    apk upgrade --no-cache libcrypto3 libssl3 curl libcurl && \
+    libcurl="$(apk query --fields version libcurl)" && libcurl="${libcurl#Version: }" && \
+    test -n "$libcurl" && test "$(apk version -t "$libcurl" 8.23.0-r0)" != "<" && \
     rm -rf /usr/local/lib/node_modules/npm && \
     rm -f /usr/local/bin/npm /usr/local/bin/npx
 
diff --git a/apps/transitous-runner/Dockerfile b/apps/transitous-runner/Dockerfile
index ecfeab382..78b64e1a7 100644
--- a/apps/transitous-runner/Dockerfile
+++ b/apps/transitous-runner/Dockerfile
@@ -84,13 +84,17 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 # git is required because the upstream attribution script reads the catalog's
 # submodule metadata; there is no credential helper and no remote configured.
-# Explicitly upgrade PCRE2 and Expat inherited from the pinned base to their
-# security fixes. The version check fails a stale mirror and, when raised,
-# invalidates this layer in the registry build cache.
+# Explicitly upgrade PCRE2 and Expat inherited from the pinned base, and
+# libssl3 and openssl (3.0.22-1~deb12u2 fixes CVE-2026-84782) that curl, git,
+# Python and ca-certificates pull in, to their security fixes. The version
+# checks fail a stale mirror and, when raised, invalidate this layer in the
+# registry build cache.
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
-      ca-certificates curl git python3 python3-pip python3-venv age libpcre2-8-0 libexpat1 \
+      ca-certificates curl git python3 python3-pip python3-venv age libpcre2-8-0 libexpat1 libssl3 openssl \
     && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libexpat1)" ge 2.5.0-1+deb12u5 \
+    && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libssl3)" ge 3.0.22-1~deb12u2 \
+    && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' openssl)" ge 3.0.22-1~deb12u2 \
     && apt-get clean -y \
     && rm -rf /var/lib/apt/lists/* \
     && rm -f /usr/lib/python3.*/EXTERNALLY-MANAGED
diff --git a/services/data-manager/Dockerfile b/services/data-manager/Dockerfile
index b67232a0f..c7c12441d 100644
--- a/services/data-manager/Dockerfile
+++ b/services/data-manager/Dockerfile
@@ -93,14 +93,20 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 # Require at least Expat's 2.5.0-1+deb12u4 security update; Debian may replace
 # older revisions in its repositories. libpcre2-8-0 fixes CVE-2026-86145,
 # CVE-2026-89157 and CVE-2026-89161. libbrotli1 1.0.9-2+deb12u1 fixes
-# CVE-2026-111497.
+# CVE-2026-111497. libssl3 and openssl 3.0.22-1~deb12u2 fix CVE-2026-84782;
+# curl, git, Python and ca-certificates pull them in, and a release build can
+# restore this layer from the registry build cache with the versions it held
+# then. Raising a version check here changes the instruction, so that layer is
+# not reused.
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
       osmium-tool curl unzip bzip2 lbzip2 ca-certificates age \
       git python3 python3-pip python3-venv wget rsync openssh-client \
-      libexpat1 libpcre2-8-0 libbrotli1 \
+      libexpat1 libpcre2-8-0 libbrotli1 libssl3 openssl \
     && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libexpat1)" ge '2.5.0-1+deb12u4' \
     && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libbrotli1)" ge '1.0.9-2+deb12u1' \
+    && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libssl3)" ge '3.0.22-1~deb12u2' \
+    && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' openssl)" ge '3.0.22-1~deb12u2' \
     && rm -rf /var/lib/apt/lists/*
 
 ARG DUCKDB_VERSION=1.5.6
diff --git a/services/motis/tools/transitous/Dockerfile b/services/motis/tools/transitous/Dockerfile
index b63985a8c..cc2aed1b1 100644
--- a/services/motis/tools/transitous/Dockerfile
+++ b/services/motis/tools/transitous/Dockerfile
@@ -22,14 +22,18 @@ ARG MOTIS_SHA256_ARM64=eda48ad1744e7be9bdd1cb515e7229e9c7ecdc3cf82c6621a64670505
 # available inside the RUN below.
 ARG TARGETARCH
 
-# Explicitly upgrade PCRE2, Expat and Brotli inherited from the pinned base to
-# their security fixes. The version checks fail a stale mirror and, when raised,
-# invalidate this layer in the registry build cache.
+# Explicitly upgrade PCRE2, Expat and Brotli inherited from the pinned base,
+# and libssl3 and openssl (3.0.22-1~deb12u2 fixes CVE-2026-84782) that curl,
+# git, Python and ca-certificates pull in, to their security fixes. The version
+# checks fail a stale mirror and, when raised, invalidate this layer in the
+# registry build cache.
 RUN apt-get update -y \
     && apt-get install -y --no-install-recommends \
-      git python3-pip python3-venv curl wget bzip2 rsync openssh-client ca-certificates age libpcre2-8-0 libexpat1 libbrotli1 \
+      git python3-pip python3-venv curl wget bzip2 rsync openssh-client ca-certificates age libpcre2-8-0 libexpat1 libbrotli1 libssl3 openssl \
     && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libexpat1)" ge 2.5.0-1+deb12u5 \
     && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libbrotli1)" ge 1.0.9-2+deb12u1 \
+    && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libssl3)" ge 3.0.22-1~deb12u2 \
+    && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' openssl)" ge 3.0.22-1~deb12u2 \
     && apt-get clean -y \
     && rm -rf /var/lib/apt/lists/* \
     && rm -f /usr/lib/python3.*/EXTERNALLY-MANAGED