diff --git a/ui/Dockerfile b/ui/Dockerfile
index 24140093270..f14b631685a 100644
--- a/ui/Dockerfile
+++ b/ui/Dockerfile
@@ -3,7 +3,7 @@
 # UI container — Next.js static export served by nginx.
 
 ARG UI_BUILD_IMAGE=node:24.19-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43
-ARG NGINX_VERSION=1.31-alpine
+ARG NGINX_VERSION=1.31.5-alpine3.24@sha256:34f40471dea485273c5e2a04dd5e97a682332ceb4a9adecd67de450dcb2fb390
 
 # ---------- builder ----------
 FROM ${UI_BUILD_IMAGE} AS builder