diff --git a/CHANGELOG.md b/CHANGELOG.md
index cc6ffb2ed..c65e5174a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,10 @@ and this project adheres to
 - ✨(backend) authenticate external API calls with Menshen exchanged tokens
 - ✨(backend) audit Menshen calls and users created from introspected tokens
 
+### Fixed
+
+- 🔒️(frontend) upgrade libx11 to fix CVE-2026-88806
+
 ## [1.35.0] - 2026-10-13
 
 ### Added
diff --git a/docker/dinum-frontend/Dockerfile b/docker/dinum-frontend/Dockerfile
index 7e43881ee..cf7736562 100644
--- a/docker/dinum-frontend/Dockerfile
+++ b/docker/dinum-frontend/Dockerfile
@@ -58,7 +58,8 @@ FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
 RUN apk upgrade --no-cache libexpat && \
-    apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' && \
+    apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' \
+        'libx11>=1.8.14-r0' && \
     apk del curl
 USER nginx
 
diff --git a/src/frontend/Dockerfile b/src/frontend/Dockerfile
index 0c01e2c3a..2c30a0ef2 100644
--- a/src/frontend/Dockerfile
+++ b/src/frontend/Dockerfile
@@ -49,7 +49,8 @@ FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
 RUN apk upgrade --no-cache libexpat && \
-    apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' && \
+    apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' \
+        'libx11>=1.8.14-r0' && \
     apk del curl
 USER nginx