diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5f4497f..1dfef51 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,11 @@ replacing a module has to be a decision with visible consequences.
 
 ## Unreleased
 
+## 0.5.1
+
+- **The image takes Debian's security fixes newer than its base** (apt, CVE-2026-109518).
+  No code change.
+
 ## 0.5.0
 
 - **Unavailable data is reported, not hidden or failed.** `/vitals` answers `disk: null` when
diff --git a/Dockerfile b/Dockerfile
index 5fe340e..adb0c6f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,6 +2,11 @@ FROM python:3.12-slim
 
 WORKDIR /app
 
+# Debian security fixes newer than the base image.
+RUN apt-get update \
+    && apt-get upgrade -y --no-install-recommends \
+    && rm -rf /var/lib/apt/lists/*
+
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
diff --git a/systemgate/main.py b/systemgate/main.py
index 52b1a28..7d42d51 100644
--- a/systemgate/main.py
+++ b/systemgate/main.py
@@ -85,7 +85,7 @@ async def lifespan(app: FastAPI):
 
 # One place, so /health and the OpenAPI document cannot disagree about
 # which version is running. They had: /health said 0.1.0 at tag v0.2.1.
-SERVICE_VERSION = "0.5.0"
+SERVICE_VERSION = "0.5.1"
 
 app = FastAPI(title="SystemGate", version=SERVICE_VERSION, lifespan=lifespan)