diff --git a/deploy/docker/Dockerfile.talmudic_engine b/deploy/docker/Dockerfile.talmudic_engine
index 1a32bfaa..458f1f8b 100644
--- a/deploy/docker/Dockerfile.talmudic_engine
+++ b/deploy/docker/Dockerfile.talmudic_engine
@@ -21,6 +21,19 @@ RUN swipl -g "consult('src/main'),halt(0)" -t "halt(1)"
 # === RUNTIME STAGE ===
 FROM --platform=linux/amd64 swipl:9.2.2
 
+# CVE-2026-111497 (Brotli decoder out-of-bounds write, October 2026).
+# The swipl:9.2.2 base carries Debian bookworm's libbrotli1 1.0.9-2,
+# pulled in by libcurl3-gnutls. Nothing in this image decodes Brotli:
+# swipl does not link it, there is no curl binary, and the engine reads
+# JSON from vav over a Unix socket. The copy was dormant, not a path.
+# Debian fixed it in 1.0.9-2+deb12u1 (bookworm-security); take that one
+# package without moving the pinned base. The pin on SWI-Prolog 9.2.2
+# (Construction §1.1) is the point of the base image, so this is
+# --only-upgrade of the one library, not a general upgrade.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends --only-upgrade libbrotli1 \
+    && rm -rf /var/lib/apt/lists/*
+
 RUN useradd --create-home --shell /bin/bash bikoret
 USER bikoret