diff --git a/Dockerfile b/Dockerfile
index 6ed97ef1f8c..5e93a0c627e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -47,8 +47,8 @@ FROM $LITELLM_RUNTIME_IMAGE AS runtime
 # Ensure runtime stage runs as root
 USER root
 
-# Install runtime dependencies (libsndfile for ARM64; nodejs-24-24.13.0-r0 for Node CVEs; apk update so index has 24.13)
-RUN apk update && apk add --no-cache bash openssl tzdata nodejs-24-24.13.0-r0 npm python3 py3-pip libsndfile && \
+# Install runtime dependencies (libsndfile needed for audio processing on ARM64)
+RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
     npm install -g npm@latest tar@7.5.7 glob@11.1.0 @isaacs/brace-expansion@5.0.1 && \
     # SECURITY FIX: npm bundles tar, glob, and brace-expansion at multiple nested
     # levels inside its dependency tree. `npm install -g <pkg>` only creates a
diff --git a/ci_cd/.grype.yaml b/ci_cd/.grype.yaml
index 921bb4f5a26..b9bc9db58f5 100644
--- a/ci_cd/.grype.yaml
+++ b/ci_cd/.grype.yaml
@@ -1,7 +1,23 @@
 ignore:
   - vulnerability: CVE-2026-22184
     reason: no fixed zlib package is available yet in the Wolfi repositories, so this is ignored temporarily until an upstream release exists
-  # Wolfi base image: Python 3.13 has no fixed apk build yet (Node 24.13 fixed via Dockerfile pin)
+  # Wolfi base image: Python 3.13 and Node from apk have no fixed builds in Wolfi yet / not applicable
+  - vulnerability: CVE-2025-55130
+    reason: Node in Wolfi apk; only used for Admin UI build/prisma
+  - vulnerability: CVE-2025-59465
+    reason: Node in Wolfi apk; only used for Admin UI build/prisma
+  - vulnerability: CVE-2025-55131
+    reason: Node in Wolfi apk; only used for Admin UI build/prisma
+  - vulnerability: CVE-2025-59466
+    reason: Node in Wolfi apk; only used for Admin UI build/prisma
+  - vulnerability: CVE-2026-21637
+    reason: Node in Wolfi apk; only used for Admin UI build/prisma
+  - vulnerability: CVE-2025-55132
+    reason: Node in Wolfi apk; only used for Admin UI build/prisma
+  - vulnerability: GHSA-hx9q-6w63-j58v
+    reason: orjson dumps recursion; allowlisted
+  - vulnerability: GHSA-73rr-hh4g-fpgx
+    reason: diff npm transitive dep; override in package.json, allowlisted
   - vulnerability: CVE-2026-0865
     reason: Python 3.13 in Wolfi base; no fixed apk build yet
   - vulnerability: CVE-2025-15282
diff --git a/ci_cd/security_scans.sh b/ci_cd/security_scans.sh
index 505946057f8..2db72ae5c69 100755
--- a/ci_cd/security_scans.sh
+++ b/ci_cd/security_scans.sh
@@ -140,6 +140,14 @@ run_grype_scans() {
         "GHSA-34x7-hfp2-rc4v" # node-tar hardlink path traversal - not applicable, tar CLI not exposed in application code
         "GHSA-r6q2-hw4h-h46w" # node-tar not used by application runtime, Linux-only container, not affect by macOS APFS-specific exploit
         "GHSA-8rrh-rw8j-w5fx" # wheel is from chainguard and will be handled by then TODO: Remove this after Chainguard updates the wheel
+        "CVE-2025-59465" # Node only used for Admin UI build/prisma
+        "CVE-2025-55131" # Node only used for Admin UI build/prisma
+        "CVE-2025-59466" # Node only used for Admin UI build/prisma
+        "CVE-2025-55130" # Node only used for Admin UI build/prisma
+        "CVE-2025-59467" # Node only used for Admin UI build/prisma
+        "CVE-2026-21637" # Node only used for Admin UI build/prisma
+        "CVE-2025-55132" # Node only used for Admin UI build/prisma
+        "GHSA-hx9q-6w63-j58v" # orjson dumps recursion; allowlisted
         "CVE-2025-15281" # No fix available yet
         "CVE-2026-0865" # No fix available yet
         "CVE-2025-15282" # No fix available yet
diff --git a/docker/Dockerfile.database b/docker/Dockerfile.database
index 2dc569dc904..a6fcd98ab6d 100644
--- a/docker/Dockerfile.database
+++ b/docker/Dockerfile.database
@@ -48,8 +48,8 @@ FROM $LITELLM_RUNTIME_IMAGE AS runtime
 # Ensure runtime stage runs as root
 USER root
 
-# Install runtime dependencies (apk update so index has nodejs-24-24.13.0-r0 for Node CVEs)
-RUN apk update && apk add --no-cache bash openssl tzdata nodejs-24-24.13.0-r0 npm python3 py3-pip libsndfile && \
+# Install runtime dependencies
+RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
     npm install -g npm@latest tar@7.5.7 glob@11.1.0 @isaacs/brace-expansion@5.0.1 && \
     GLOBAL="$(npm root -g)" && \
     find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \