diff --git a/Dockerfile b/Dockerfile
index 386d044..ea01e70 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,6 +9,10 @@ ARG CACHE_BUST=
 RUN dnf install -y \
       https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm \
       https://rpms.remirepo.net/enterprise/remi-release-10.rpm && \
+    # Use Remi's origin, not the mirrorlist: during the 2026-10-21 PHP security
+    # release the mirrors lagged hours behind (still 8.2.34 when 8.2.35 was out),
+    # so builds shipped unpatched PHP. Packages stay GPG-checked (gpgcheck=1).
+    sed -i -e 's/^#baseurl=/baseurl=/' -e 's/^mirrorlist=/#mirrorlist=/' /etc/yum.repos.d/remi*.repo && \
     dnf update -y && \
     dnf install -y httpd mod_ssl openssl wget procps cronie iproute postgresql-devel microdnf less git \
       nano rsync unzip zip mariadb bind-utils jq patch nc tree dos2unix && \
diff --git a/Dockerfile.fpm b/Dockerfile.fpm
index 96a2e27..0c16f90 100644
--- a/Dockerfile.fpm
+++ b/Dockerfile.fpm
@@ -9,6 +9,10 @@ ARG CACHE_BUST=
 RUN dnf install -y \
       https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm \
       https://rpms.remirepo.net/enterprise/remi-release-10.rpm && \
+    # Use Remi's origin, not the mirrorlist: during the 2026-10-21 PHP security
+    # release the mirrors lagged hours behind (still 8.2.34 when 8.2.35 was out),
+    # so builds shipped unpatched PHP. Packages stay GPG-checked (gpgcheck=1).
+    sed -i -e 's/^#baseurl=/baseurl=/' -e 's/^mirrorlist=/#mirrorlist=/' /etc/yum.repos.d/remi*.repo && \
     dnf update -y && \
     dnf install -y openssl wget procps cronie iproute postgresql-devel microdnf less git \
       nano rsync unzip zip mariadb bind-utils jq patch nc tree dos2unix fcgi && \