diff --git a/Dockerfile b/Dockerfile
index 47d625e7687..8660251a902 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,21 +13,22 @@ WORKDIR /app
 USER root
 
 # Install build dependencies
-RUN apk add --no-cache bash gcc git openssl openssl-dev
+RUN apk add --no-cache bash gcc git curl build-base openssl openssl-dev
 
 RUN python -m pip install --upgrade pip setuptools && \
     python -m pip install build wheel cmake setuptools_rust maturin
 
+# Install build dependencies needed for git-based packages
+RUN pip install --no-cache-dir hatchling hatch-vcs
+
 # Configure Rust environment for building Rust-backed Python wheels
 ENV CARGO_HOME=/root/.cargo
 ENV PATH=/root/.cargo/bin:$PATH
 # Allow forward-compatible ABI for PyO3-based packages on Python 3.14
 ENV PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1
 
-RUN apk add --no-cache curl build-base openssl-dev && \
-    curl https://sh.rustup.rs -sSf | sh -s -- -y && \
-    rustup default stable && \
-    python -m pip install maturin
+RUN curl https://sh.rustup.rs -sSf | sh -s -- -y && \
+    rustup default stable
 
 # Copy the current directory contents into the container at /app
 COPY . .
@@ -45,9 +46,6 @@ RUN ls -1 dist/*.whl | head -1
 # Install the package
 RUN pip install dist/*.whl
 
-# Install build dependencies needed for git-based packages
-RUN pip install --no-cache-dir hatchling hatch-vcs
-
 # Install dependencies as wheels, force binary for Pillow/tokenizers to avoid build issues
 RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ --only-binary=Pillow,tokenizers -r requirements.txt
 # ensure pyjwt is used, not jwt
diff --git a/ci_cd/.grype.yaml b/ci_cd/.grype.yaml
index b9bc9db58f5..12bde6c762b 100644
--- a/ci_cd/.grype.yaml
+++ b/ci_cd/.grype.yaml
@@ -1,7 +1,7 @@
 ignore:
   - vulnerability: CVE-2026-22184
     reason: no fixed zlib package is available yet in the Wolfi repositories, so this is ignored temporarily until an upstream release exists
-  # Wolfi base image: Python 3.13 and Node from apk have no fixed builds in Wolfi yet / not applicable
+  # Chainguard base image: Node from apk has no fixed builds yet / not applicable
   - vulnerability: CVE-2025-55130
     reason: Node in Wolfi apk; only used for Admin UI build/prisma
   - vulnerability: CVE-2025-59465
@@ -19,18 +19,18 @@ ignore:
   - vulnerability: GHSA-73rr-hh4g-fpgx
     reason: diff npm transitive dep; override in package.json, allowlisted
   - vulnerability: CVE-2026-0865
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+    reason: Python in Chainguard base; no fixed apk build yet
   - vulnerability: CVE-2025-15282
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+    reason: Python in Chainguard base; no fixed apk build yet
   - vulnerability: CVE-2026-0672
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+    reason: Python in Chainguard base; no fixed apk build yet
   - vulnerability: CVE-2025-15366
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+    reason: Python in Chainguard base; no fixed apk build yet
   - vulnerability: CVE-2025-15367
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+    reason: Python in Chainguard base; no fixed apk build yet
   - vulnerability: CVE-2025-11468
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+    reason: Python in Chainguard base; no fixed apk build yet
   - vulnerability: CVE-2025-12781
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+    reason: Python in Chainguard base; no fixed apk build yet
   - vulnerability: CVE-2026-1299
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+    reason: Python in Chainguard base; no fixed apk build yet
diff --git a/ci_cd/security_scans.sh b/ci_cd/security_scans.sh
index 2db72ae5c69..c75e594c25b 100755
--- a/ci_cd/security_scans.sh
+++ b/ci_cd/security_scans.sh
@@ -126,8 +126,8 @@ run_grype_scans() {
         "GHSA-4xh5-x5gv-qwph"
         "CVE-2025-8291" # no fix available as of Oct 11, 2025
         "GHSA-5j98-mcp5-4vw2"
-        "CVE-2025-13836" # Python 3.13 HTTP response reading OOM/DoS - no fix available in base image
-        "CVE-2025-12084" # Python 3.13 xml.dom.minidom quadratic algorithm - no fix available in base image
+        "CVE-2025-13836" # Python HTTP response reading OOM/DoS - no fix available in base image
+        "CVE-2025-12084" # Python xml.dom.minidom quadratic algorithm - no fix available in base image
         "CVE-2025-60876" # BusyBox wget HTTP request splitting - no fix available in Chainguard Wolfi base image
         "CVE-2026-0861" # Wolfi glibc still flagged even on 2.42-r5; upstream patched build unavailable yet
         "CVE-2010-4756" # glibc glob DoS - awaiting patched Wolfi glibc build
@@ -156,7 +156,7 @@ run_grype_scans() {
         "CVE-2025-15367" # No fix available yet
         "CVE-2025-12781" # No fix available yet
         "CVE-2025-11468" # No fix available yet
-        "CVE-2026-1299" # Python 3.13 email module header injection - not applicable, LiteLLM doesn't use BytesGenerator for email serialization
+        "CVE-2026-1299" # Python email module header injection - not applicable, LiteLLM doesn't use BytesGenerator for email serialization
         "CVE-2026-0775" # npm cli incorrect permission assignment - no fix available yet, npm is only used at build/prisma-generate time
     )
 
diff --git a/docker/Dockerfile.non_root b/docker/Dockerfile.non_root
index f9b96ec85ed..b6ca23c5715 100644
--- a/docker/Dockerfile.non_root
+++ b/docker/Dockerfile.non_root
@@ -2,12 +2,15 @@
 ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/python:latest-dev
 ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/python:latest-dev
 ARG PROXY_EXTRAS_SOURCE=published
+# Python version shipped in the Chainguard base image (update when base image changes)
+ARG PYTHON_VERSION=3.14
 
 # -----------------
 # Builder Stage
 # -----------------
 FROM $LITELLM_BUILD_IMAGE AS builder
 ARG PROXY_EXTRAS_SOURCE
+ARG PYTHON_VERSION
 WORKDIR /app
 USER root
 
@@ -89,7 +92,7 @@ RUN if [ "$PROXY_EXTRAS_SOURCE" = "local" ]; then \
 ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
     PRISMA_CLI_BINARY_TARGETS="debian-openssl-3.0.x" \
     XDG_CACHE_HOME=/app/.cache \
-    PATH="/usr/lib/python3.14/site-packages/nodejs/bin:${PATH}"
+    PATH="/usr/lib/python${PYTHON_VERSION}/site-packages/nodejs/bin:${PATH}"
 
 RUN pip install --no-cache-dir prisma==0.11.0 nodejs-wheel-binaries==24.12.0 \
     && mkdir -p /app/.cache/npm
@@ -106,6 +109,7 @@ RUN prisma generate && \
 # -----------------
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
 ARG PROXY_EXTRAS_SOURCE
+ARG PYTHON_VERSION
 WORKDIR /app
 USER root
 
@@ -142,11 +146,11 @@ COPY --from=builder /var/lib/litellm/assets /var/lib/litellm/assets
 COPY --from=builder /app/.cache /app/.cache
 COPY --from=builder /app/litellm-proxy-extras /app/litellm-proxy-extras
 COPY --from=builder \
-  /usr/lib/python3.14/site-packages/nodejs* \
-  /usr/lib/python3.14/site-packages/prisma* \
-  /usr/lib/python3.14/site-packages/tomlkit* \
-  /usr/lib/python3.14/site-packages/nodeenv* \
-  /usr/lib/python3.14/site-packages/
+  /usr/lib/python${PYTHON_VERSION}/site-packages/nodejs* \
+  /usr/lib/python${PYTHON_VERSION}/site-packages/prisma* \
+  /usr/lib/python${PYTHON_VERSION}/site-packages/tomlkit* \
+  /usr/lib/python${PYTHON_VERSION}/site-packages/nodeenv* \
+  /usr/lib/python${PYTHON_VERSION}/site-packages/
 COPY --from=builder /usr/bin/prisma /usr/bin/prisma
 
 # Final runtime environment configuration
diff --git a/docker/tests/nonroot.yaml b/docker/tests/nonroot.yaml
index 821b1a105ae..f2c9871bba2 100644
--- a/docker/tests/nonroot.yaml
+++ b/docker/tests/nonroot.yaml
@@ -7,12 +7,12 @@ metadataTest:
 
 fileExistenceTests:
   - name: "Prisma Folder"
-    path: "/usr/local/lib/python3.13/site-packages/prisma/"
+    path: "/usr/lib/python3.14/site-packages/prisma/"
     shouldExist: true
     uid: 65534
     gid: 65534
   - name: "Prisma Schema"
-    path: "/usr/local/lib/python3.13/site-packages/prisma/schema.prisma"
+    path: "/usr/lib/python3.14/site-packages/prisma/schema.prisma"
     shouldExist: true
     uid: 65534
     gid: 65534