diff --git a/Dockerfile b/Dockerfile
index 0f5a770..414f5f4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,10 @@
 # pinned nginx-unprivileged runtime serving the static dist/.
 
 # ---- build stage ----------------------------------------------------------
-FROM node:22-bookworm-slim AS build
+# Digest-pinned (was a floating tag → the docker.io re-resolve was the CI "build hang"). With the bastion
+# runner pointed at the zot pull-through mirror, this exact layer is fetched once and cached. Bump the digest
+# when intentionally moving Node. node:22-bookworm-slim index digest resolved 2026-06-23.
+FROM node:22-bookworm-slim@sha256:d9f850096136edbc402debdd8729579a288aac64574ada0ff4db26b6ae58b0b2 AS build
 WORKDIR /app
 
 # Install deps from the lockfile only first (better layer caching).