diff --git a/CHANGELOG.md b/CHANGELOG.md
index 630269d7..14dc6eb0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,7 @@ and this project adheres to
 - 🐛(frontend) enforce recording-mode permissions on the checkboxes
 - 🔒️(agents) fix util-linux CVEs reported by Cyberwatch
 - 🔒️(backend) fix HIGH CVEs in Django and urllib3
+- 🔒️(agents) upgrade libpcre2-8-0 to fix CVE-2026-103111
 
 ## [1.33.0] - 2026-09-30
 
diff --git a/src/agents/Dockerfile b/src/agents/Dockerfile
index 909e4eea..044fa0a1 100644
--- a/src/agents/Dockerfile
+++ b/src/agents/Dockerfile
@@ -5,6 +5,7 @@ RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sou
     && apt-get update && apt-get install -y --no-install-recommends  \
     libglib2.0-0 \
     libgobject-2.0-0 \
+    libpcre2-8-0 \
     libssl3t64 \
     && rm -rf /var/lib/apt/lists/*