diff --git a/reposilite-frontend/Dockerfile b/reposilite-frontend/Dockerfile
index 4b7479948..0938e3383 100644
--- a/reposilite-frontend/Dockerfile
+++ b/reposilite-frontend/Dockerfile
@@ -56,6 +56,14 @@ RUN set -eu; \
 # starting as root and dropping privileges the way the stock nginx image does.
 FROM nginxinc/nginx-unprivileged:1.31-alpine@sha256:378d0c32f6562f7fd9629170797f57d2b953aa09be983b3daaf4809bb039ca00 AS run
 
+# The pinned base still ships libexpat 2.8.5 (CVE-2026-77214, fixed in 2.9.0). Upgrade just
+# that package, as root for the duration of this step only, then drop back to the unprivileged
+# user the base image runs as. Remove this once the base image carries the fixed version.
+USER root
+RUN apk upgrade --no-cache libexpat \
+    && apk info -v libexpat
+USER 101
+
 # Where to reach the server, and how to resolve it. 127.0.0.11 is Docker's embedded DNS; on
 # Kubernetes this wants the cluster resolver instead.
 ENV INGOT_BACKEND="http://ingot-backend:8080" \