diff --git a/dstack/kms/auth-mock/Dockerfile b/dstack/kms/auth-mock/Dockerfile
index 75207418a..75ecb5187 100644
--- a/dstack/kms/auth-mock/Dockerfile
+++ b/dstack/kms/auth-mock/Dockerfile
@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-FROM oven/bun:1-alpine
+FROM oven/bun:1.4.4-alpine@sha256:4cf82f5686b196504fe119db3fcd9185b191f82ece82c40680e597228ec6070a
 WORKDIR /app
 
 ARG DSTACK_REV
diff --git a/dstack/kms/dstack-app/compose-dev.yaml b/dstack/kms/dstack-app/compose-dev.yaml
index a642b3218..02e17c4b5 100644
--- a/dstack/kms/dstack-app/compose-dev.yaml
+++ b/dstack/kms/dstack-app/compose-dev.yaml
@@ -8,7 +8,7 @@ services:
     build:
       context: .
       dockerfile_inline: |
-        FROM node:20-bookworm-slim@sha256:2cf067cfed83d5ea958367df9f966191a942351a2df77d6f0193e162b5febfc0
+        FROM node:22.23.4-bookworm-slim@sha256:de170b39439eb0e5a3444ad7d60b015614a381e10fecae2e30ec9e735122f38d
         WORKDIR /app
 
         RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates && rm -rf /var/lib/apt/lists/*
diff --git a/dstack/kms/dstack-app/docker-compose.yaml b/dstack/kms/dstack-app/docker-compose.yaml
index a83d5f334..4fb1b603f 100644
--- a/dstack/kms/dstack-app/docker-compose.yaml
+++ b/dstack/kms/dstack-app/docker-compose.yaml
@@ -32,7 +32,7 @@ services:
     build:
       context: .
       dockerfile_inline: |
-        FROM node:20-bookworm-slim@sha256:2cf067cfed83d5ea958367df9f966191a942351a2df77d6f0193e162b5febfc0
+        FROM node:22.23.4-bookworm-slim@sha256:de170b39439eb0e5a3444ad7d60b015614a381e10fecae2e30ec9e735122f38d
         WORKDIR /app
 
         RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates && rm -rf /var/lib/apt/lists/*