diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml
index 91c8425..786e832 100644
--- a/.github/workflows/docker-build-push.yml
+++ b/.github/workflows/docker-build-push.yml
@@ -12,13 +12,59 @@ jobs:
   build:
     runs-on: ubuntu-latest
 
-    env:
-      IMAGE_VERSION: bookworm_rust_1.88-node_22.17.1
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v2
 
+      - name: Extract versions from Dockerfile
+        id: versions
+        run: |
+          RUST_VERSION=$(grep -E '^[[:space:]]*RUST_VERSION=' Dockerfile | head -1 | cut -d'=' -f2)
+          NODE_VERSION=$(grep -E '^ENV NODE_VERSION' Dockerfile | head -1 | awk '{print $3}')
+          IMAGE_VERSION="bookworm_rust_${RUST_VERSION}-node_${NODE_VERSION}"
+          echo "rust_version=${RUST_VERSION}" >> $GITHUB_OUTPUT
+          echo "node_version=${NODE_VERSION}" >> $GITHUB_OUTPUT
+          echo "image_version=${IMAGE_VERSION}" >> $GITHUB_OUTPUT
+          echo "Detected versions: Rust ${RUST_VERSION}, Node ${NODE_VERSION}"
+          echo "Image version: ${IMAGE_VERSION}"
+
+      - name: Validate extracted versions
+        run: |
+          RUST_VERSION="${{ steps.versions.outputs.rust_version }}"
+          NODE_VERSION="${{ steps.versions.outputs.node_version }}"
+          IMAGE_VERSION="${{ steps.versions.outputs.image_version }}"
+
+          # Check RUST_VERSION is not empty and matches version pattern
+          if [ -z "$RUST_VERSION" ]; then
+            echo "::error::Failed to extract RUST_VERSION from Dockerfile"
+            exit 1
+          fi
+          if ! echo "$RUST_VERSION" | grep -qE '^[0-9]+\.[0-9]+'; then
+            echo "::error::RUST_VERSION '$RUST_VERSION' does not match expected pattern (e.g., 1.88)"
+            exit 1
+          fi
+
+          # Check NODE_VERSION is not empty and matches version pattern
+          if [ -z "$NODE_VERSION" ]; then
+            echo "::error::Failed to extract NODE_VERSION from Dockerfile"
+            exit 1
+          fi
+          if ! echo "$NODE_VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error::NODE_VERSION '$NODE_VERSION' does not match expected pattern (e.g., 22.17.1)"
+            exit 1
+          fi
+
+          # Validate final image version format
+          if ! echo "$IMAGE_VERSION" | grep -qE '^bookworm_rust_[0-9]+\.[0-9]+-node_[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error::IMAGE_VERSION '$IMAGE_VERSION' does not match expected format"
+            exit 1
+          fi
+
+          echo "Validation passed:"
+          echo "  RUST_VERSION: $RUST_VERSION"
+          echo "  NODE_VERSION: $NODE_VERSION"
+          echo "  IMAGE_VERSION: $IMAGE_VERSION"
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v1
 
@@ -32,7 +78,7 @@ jobs:
           docker buildx create --use
           if [ "${{ github.event_name }}" = "push" ]; then
             docker buildx build --push \
-              --tag ghcr.io/$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]'):${{ env.IMAGE_VERSION }} \
+              --tag ghcr.io/$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]'):${{ steps.versions.outputs.image_version }} \
               --platform linux/amd64,linux/arm64 .
           else
             docker buildx build \
diff --git a/Dockerfile b/Dockerfile
index 31817ef..57b99eb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -45,12 +45,13 @@ RUN ((cat /etc/os-release | grep ID | grep alpine) && apk add --no-cache musl-de
     && rm -rf $CARGO_HOME/registry/
 
 # ----------------------
-# node 22.17.1 via https://github.com/nodejs/docker-node/blob/main/22/bookworm/Dockerfile
+# node 22.22.0 via https://github.com/nodejs/docker-node/blob/main/22/bookworm/Dockerfile
+# security fix: https://nodejs.org/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks
 # ----------------------
 RUN groupadd --gid 1000 node \
   && useradd --uid 1000 --gid node --shell /bin/bash --create-home node
 
-ENV NODE_VERSION 22.17.1
+ENV NODE_VERSION 22.22.0
 
 RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" \
   && case "${dpkgArch##*-}" in \