diff --git a/Dockerfile b/Dockerfile
index 60ff149..ec36562 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,7 @@
-FROM ruby:3.1-bullseye AS builder
+# ruby:3.1-bullseye, pinned 2026-02-22
+FROM ruby@sha256:4cc0e5aaa726f8c2cbf1dfc8e5ecd459dbfbebe44b5eee5da6f79ffcc1b6c36f AS builder
 
-RUN apt update && apt install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     bsdmainutils \
     build-essential \
     make \
@@ -11,7 +12,8 @@ RUN apt update && apt install -y \
     libxslt-dev \
     pkg-config \
     python3 \
-    xz-utils
+    xz-utils \
+    && rm -rf /var/lib/apt/lists/*
 
 # Node.js 20.18.3 LTS, pinned by sha256
 RUN cd /tmp && \
@@ -21,7 +23,8 @@ RUN cd /tmp && \
     rm node-v20.18.3-linux-x64.tar.xz
 
 RUN npm install -g yarn && \
-    yarn global add prettier
+    yarn global add prettier && \
+    npm install -g wrangler
 
 ADD ./Gemfile* ./