diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index f19f9ce..2522709 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -63,7 +63,7 @@ jobs:
     needs: [web]
     runs-on: light
     container:
-      image: golang:1.27-bookworm@sha256:69a7b9788769bec032d238959b61854e9ae87f57be9029ec04e9885fabf99195 # 1.27-bookworm
+      image: golang:1.27-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61 # 1.27-bookworm
     steps:
       - uses: coffey-labs/actions/checkout@fab0c4d45e0162963965f1555df27b7bed5e20ec
       - run: go vet ./...
diff --git a/Dockerfile b/Dockerfile
index 8a25669..a8ede0a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,8 @@
 # ---- web build ----
-FROM node:26-alpine AS web
+# Docker Hub's official images, pulled through Google's mirror: GitHub's
+# shared runners hit Docker Hub's anonymous pull limit (429), which the
+# mirror is not subject to. Same images, same digests (checked 2026-10-09).
+FROM mirror.gcr.io/library/node:26-alpine AS web
 WORKDIR /src/web
 COPY web/package.json web/package-lock.json ./
 RUN npm ci --ignore-scripts --no-audit --no-fund
@@ -7,7 +10,7 @@ COPY web/ ./
 RUN npm run build
 
 # ---- go build ----
-FROM golang:1.27-alpine AS build
+FROM mirror.gcr.io/library/golang:1.27-alpine AS build
 # The version string the binary reports. Worked out by whoever runs the
 # build (CI passes the tag); left empty it says "dev".
 ARG IHASVPN_VERSION=dev
@@ -20,7 +23,7 @@ COPY --from=web /src/internal/server/static/dist internal/server/static/dist
 RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X github.com/Coffey-Labs/ihasvpn/internal/engine.Version=${IHASVPN_VERSION}" -o /ihasvpn ./cmd/ihasvpn
 
 # ---- runtime ----
-FROM alpine:3.22
+FROM mirror.gcr.io/library/alpine:3.22
 # nftables does the NAT; wireguard-go is the fallback data plane for hosts
 # without the kernel module; wireguard-tools gives `wg show` for debugging.
 RUN apk add --no-cache nftables wireguard-go wireguard-tools ca-certificates tzdata \
diff --git a/go.mod b/go.mod
index d984d91..89d2a3f 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/Coffey-Labs/ihasvpn
 
-go 1.27.1
+go 1.27.2
 
 require (
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
@@ -23,7 +23,7 @@ require (
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
-	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/net v0.60.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/sys v0.48.0 // indirect
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 // indirect
diff --git a/go.sum b/go.sum
index 2409392..d8e15d0 100644
--- a/go.sum
+++ b/go.sum
@@ -34,8 +34,8 @@ golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
 golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
 golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=