diff --git a/.docker/release/Dockerfile b/.docker/release/Dockerfile
index d6675462e..aa954c384 100644
--- a/.docker/release/Dockerfile
+++ b/.docker/release/Dockerfile
@@ -23,7 +23,9 @@ RUN set -eux; \
     rm -v /snappymail/README.md /snappymail/_include.php
 
 # Inspired by the original Rainloop dockerfile from youtous on GitLab
-FROM php:8.2-fpm-alpine AS final
+# PHP is pinned to a patch release so each image ships a known PHP version.
+# 8.2.35 fixes CVE-2026-109618 and CVE-2026-109619. Bump this on new PHP security releases.
+FROM php:8.2.35-fpm-alpine AS final
 
 LABEL org.label-schema.description="SnappyMail webmail client image using nginx, php-fpm on Alpine"
 
diff --git a/.docker/release/test/config.yaml b/.docker/release/test/config.yaml
index 47cf00ea9..b322d6891 100644
--- a/.docker/release/test/config.yaml
+++ b/.docker/release/test/config.yaml
@@ -2,6 +2,12 @@
 # See: https://github.com/GoogleContainerTools/container-structure-test/issues/78
 schemaVersion: 2.0.0
 commandTests:
+  - name: PHP version includes fixes for CVE-2026-109618 and CVE-2026-109619
+    command: php
+    args:
+      - -r
+      - 'echo PHP_VERSION, PHP_EOL; exit(version_compare(PHP_VERSION, "8.2.35", ">=") ? 0 : 1);'
+    exitCode: 0
   - name: Integration test
     command: /bin/sh
     args: