diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..93495ec
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,19 @@
+.git
+.idea
+.DS_Store
+.env
+.env.*
+!.env.example
+vendor
+node_modules
+bootstrap/cache/*.php
+storage/logs/*
+storage/framework/cache/*
+storage/framework/sessions/*
+storage/framework/views/*
+storage/*.key
+helm-chart/secrets*.yml
+helm-chart/*secret*.yaml
+helm-chart/*.pem
+.phpunit.cache
+.phpunit.result.cache
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 2a76a6a..1dbd261 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -33,9 +33,9 @@ jobs:
            password: ${{ secrets.REGISTRY_PASSWORD }}
        - name: Build and push application image
          env:
-           SWAGGER_URL: ${{ vars.SWAGGER_URL_DEV }}
+           SWAGGER_URL: ${{ vars.SWAGGER_URL_DEV || secrets.SWAGGER_URL_DEV }}
          run: |
-           : "${SWAGGER_URL:?Set the SWAGGER_URL_DEV repository variable}"
+           : "${SWAGGER_URL:?Set the SWAGGER_URL_DEV repository variable or secret}"
            docker build --build-arg "SWAGGER_URL=$SWAGGER_URL" -t ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:${{ github.sha }} -f ./docker/Dockerfile .
            docker tag ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:${{ github.sha }} ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:latest
 
diff --git a/.github/workflows/production-pipeline.yml b/.github/workflows/production-pipeline.yml
index 6aae480..a8d9b79 100644
--- a/.github/workflows/production-pipeline.yml
+++ b/.github/workflows/production-pipeline.yml
@@ -29,9 +29,9 @@ jobs:
           password: ${{ secrets.REGISTRY_PASSWORD }}
       - name: Build and push application image
         env:
-          SWAGGER_URL: ${{ vars.SWAGGER_URL_PROD }}
+          SWAGGER_URL: ${{ vars.SWAGGER_URL_PROD || secrets.SWAGGER_URL_PROD }}
         run: |
-          : "${SWAGGER_URL:?Set the SWAGGER_URL_PROD repository variable}"
+          : "${SWAGGER_URL:?Set the SWAGGER_URL_PROD repository variable or secret}"
           docker build --build-arg "SWAGGER_URL=$SWAGGER_URL" -t ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:${{ github.sha }} -f ./docker/Dockerfile .
           docker tag ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:${{ github.sha }} ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:latest
           docker push ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:${{ github.sha }}
diff --git a/.github/workflows/qa-pipeline.yml b/.github/workflows/qa-pipeline.yml
index cb7c073..ba0df0e 100644
--- a/.github/workflows/qa-pipeline.yml
+++ b/.github/workflows/qa-pipeline.yml
@@ -35,9 +35,9 @@ jobs:
           password: ${{ secrets.REGISTRY_PASSWORD }}
       - name: Build and push application image
         env:
-          SWAGGER_URL: ${{ vars.SWAGGER_URL_QA }}
+          SWAGGER_URL: ${{ vars.SWAGGER_URL_QA || secrets.SWAGGER_URL_QA }}
         run: |
-          : "${SWAGGER_URL:?Set the SWAGGER_URL_QA repository variable}"
+          : "${SWAGGER_URL:?Set the SWAGGER_URL_QA repository variable or secret}"
           docker build --build-arg "SWAGGER_URL=$SWAGGER_URL" -t ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi-qa:${{ github.sha }} -f ./docker/Dockerfile .
           docker tag ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi-qa:${{ github.sha }} ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi-qa:latest
           docker push ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi-qa:${{ github.sha }}
diff --git a/REDME.md b/REDME.md
index 9acf37c..6fca24a 100644
--- a/REDME.md
+++ b/REDME.md
@@ -7,7 +7,7 @@ WhatNow is a web application built with Laravel 13 and Vue.js that provides disa
 
 Make sure the following tools are installed on your system:
 
-- **PHP (version 8.3.36 or later, with the security patch for CVE-2026-109618 and CVE-2026-109619):**
+- **PHP (version 8.4.1 or later; Docker and CI use PHP 8.4):**
   ```bash
   php -v
   ```
@@ -108,7 +108,7 @@ The API and the backoffice are now connected and ready to use.
 
 ## Swagger URL for Docker Builds
 
-Set the GitHub Actions repository variables `SWAGGER_URL_DEV`, `SWAGGER_URL_QA`,
+Set the GitHub Actions repository variables or secrets `SWAGGER_URL_DEV`, `SWAGGER_URL_QA`,
 and `SWAGGER_URL_PROD` to the public API origin for each deployment. Use the origin
 without `/v2`; the Swagger configuration appends that path. The workflows pass
 this value through the required `SWAGGER_URL` Docker build argument instead of
diff --git a/bitbucket-pipelines.yml b/bitbucket-pipelines.yml
index 26fdb22..13246c1 100644
--- a/bitbucket-pipelines.yml
+++ b/bitbucket-pipelines.yml
@@ -1,4 +1,4 @@
-image: php:8.3.36
+image: php:8.4-cli-bookworm
 
 definitions:
   services:
diff --git a/composer.json b/composer.json
index c132869..c0cd0d9 100644
--- a/composer.json
+++ b/composer.json
@@ -8,7 +8,7 @@
     ],
     "license": "MIT",
     "require": {
-        "php": "^8.3.36",
+        "php": "^8.4.1",
         "darkaonline/l5-swagger": "^8.6 || ^9.0 || ^10.0 || ^11.0",
         "doctrine/annotations": "^2.0",
         "laravel/framework": "^13.0",
@@ -30,7 +30,10 @@
     "config": {
         "optimize-autoloader": true,
         "preferred-install": "dist",
-        "sort-packages": true
+        "sort-packages": true,
+        "platform": {
+            "php": "8.4.1"
+        }
     },
     "extra": {
         "laravel": {
diff --git a/composer.lock b/composer.lock
index ebac53c..1a64b43 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "9a596cf86d9c4b06c1dc36196d21b076",
+    "content-hash": "f0021aa15a7b80bf0d998bd3602b65f7",
     "packages": [
         {
             "name": "aws/aws-crt-php",
@@ -9460,8 +9460,11 @@
     "prefer-stable": true,
     "prefer-lowest": false,
     "platform": {
-        "php": "^8.3.36"
+        "php": "^8.4.1"
     },
     "platform-dev": {},
+    "platform-overrides": {
+        "php": "8.4.1"
+    },
     "plugin-api-version": "2.9.0"
 }
diff --git a/docker/Dockerfile b/docker/Dockerfile
index b6556d9..d5015ba 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,7 +1,6 @@
-# PHP 8.3.36+ includes security patches for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)
-FROM php:8.3.36-apache
+FROM php:8.4-apache-bookworm
 
-RUN php -r 'if (version_compare(PHP_VERSION, "8.3.36", "<")) { fwrite(STDERR, "PHP >= 8.3.36 is required to patch CVE-2026-109618 and CVE-2026-109619\n"); exit(1); }'
+RUN php -r 'if (version_compare(PHP_VERSION, "8.4.1", "<")) { fwrite(STDERR, "PHP >= 8.4.1 is required by the locked dependencies\n"); exit(1); }'
 
 COPY --from=composer:latest /usr/bin/composer /usr/local/bin/composer
 
@@ -20,7 +19,9 @@ COPY ./docker/vhost.conf /etc/apache2/sites-available/000-default.conf
 COPY ./ /var/www/html
 
 WORKDIR /var/www/html
-RUN composer install --no-dev --prefer-dist --optimize-autoloader
+RUN composer validate --strict --no-check-publish \
+    && composer install --no-dev --prefer-dist --optimize-autoloader --no-interaction \
+    && composer check-platform-reqs --no-dev
 
 ARG SWAGGER_URL
 RUN : "${SWAGGER_URL:?SWAGGER_URL build argument is required}" \