diff --git a/Dockerfile b/Dockerfile
index e50d8ad..5da9d46 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -28,9 +28,9 @@ ENV LANG=C.UTF-8 \
 # the SaneSecurity rsync temp files at the end of the layer.
 #
 # Pinning strategy:
-#   - PHP 8.4: AlmaLinux 10 stock ships PHP 8.3 only; the spec asks for
-#     8.4 specifically. We add Remi's modular repo and enable the
-#     `php:remi-8.4` stream. We DO NOT pin to a specific 8.4.X because
+#   - PHP 8.5: AlmaLinux 10 stock ships PHP 8.3 only; the spec asks for
+#     a current Remi stream (8.5; the 8.4 stream had a known exploit). We
+#     add Remi's modular repo and enable the `php:remi-8.5` stream. We DO NOT pin to a specific 8.5.X because
 #     Remi rolls security patches into the same minor and an exact pin
 #     would block updates.
 #   - clamav / clamav-update: track the AL10 EPEL stream. CI builds
@@ -50,11 +50,11 @@ RUN set -eux; \
         dnf \
         shadow-utils \
         ; \
-    # Add Remi's repo for PHP 8.4 (AL10 stock has 8.3 only).
+    # Add Remi's repo for PHP 8.5 (AL10 stock has 8.3 only).
     dnf -y --setopt=install_weak_deps=0 install \
         https://rpms.remirepo.net/enterprise/remi-release-10.rpm ; \
     dnf -y --setopt=install_weak_deps=0 module reset php ; \
-    dnf -y --setopt=install_weak_deps=0 module enable php:remi-8.4 ; \
+    dnf -y --setopt=install_weak_deps=0 module enable php:remi-8.5 ; \
     # Pre-create the worker BEFORE installing clamav so virusgroup
     # doesn't claim our GID.
     groupadd --system --gid ${WHP_GID} whp-import ; \