diff --git a/Dockerfile b/Dockerfile
index 315ca9e0..daa259e8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -101,8 +101,14 @@ RUN if [ "$TARGETARCH" = "$BUILDARCH" ]; then \
 # Runs on the BUILD platform; GOARCH cross-compiles the static binary for TARGET.
 # The fetch pulls only the v29.4.1 commit, minimising transfer size.
 # docker/cli uses CalVer and ships vendor.mod instead of go.mod to avoid SemVer
-# compliance requirements. We copy vendor.mod -> go.mod and build with -mod=vendor
-# so all deps come from the vendored tree (no network access needed).
+# compliance requirements. We copy vendor.mod -> go.mod, drop the committed vendor
+# tree, bump golang.org/x/net to v0.55.0, and build with -mod=mod so the patched
+# module is resolved from the module proxy instead of the pinned v0.53.0 that the
+# image scan flags for six HIGH advisories (CVE-2026-25680, -25681, -27136, -39821,
+# -42502, -42506; x/net/html parsing and x/net/idna). Removing vendor/ keeps -mod=mod
+# from reading the stale copy, and avoids `go mod tidy` (which does not run cleanly
+# against docker/cli's vendor.mod manifest). This stage now fetches modules at build
+# time rather than building fully offline.
 # Base image pinned by digest so the Go toolchain that compiles the static
 # Docker CLI binary cannot change without an explicit Dependabot bump.
 FROM --platform=$BUILDPLATFORM golang:1.26.4-alpine@sha256:f1ddd9fe14fffc091dd98cb4bfa999f32c5fc77d2f2305ea9f0e2595c5437c14 AS cli-builder
@@ -125,8 +131,10 @@ WORKDIR /src/docker-cli
 RUN mkdir -p /build
 
 RUN cp vendor.mod go.mod && cp vendor.sum go.sum && \
+    rm -rf vendor && \
+    go get golang.org/x/net@v0.55.0 && \
     CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build \
-      -mod=vendor \
+      -mod=mod \
       -ldflags "-extldflags=-static \
         -X github.com/docker/cli/cli/version.Version=29.4.1 \
         -X github.com/docker/cli/cli/version.GitCommit=source-go1.26.3" \