diff --git a/CHANGELOG.md b/CHANGELOG.md
index 059a117..650ac2e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.4.1
+
+### Security
+
+- The Docker image no longer trusts the eight eMudhra intermediates whose keys leaked: it upgrades Alpine's CA bundle to 20261020-r0 and runs Node with `--use-openssl-ca`, because Node's built-in roots still accept them. The npm package and the Action are not changed by this release: they run on your own Node and your own CA store.
+
 ## 0.4.0
 
 ### Breaking
diff --git a/Dockerfile b/Dockerfile
index 86ed59b..7512308 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,6 +7,10 @@ COPY src/ src/
 RUN npm run build
 
 FROM node:26-alpine
+# The base image's CA bundle predates the eMudhra distrust (2026-10-20); run Node
+# on that patched system bundle, because its built-in roots still trust them.
+RUN apk add --no-cache 'ca-certificates-bundle>=20261020-r0'
+ENV NODE_OPTIONS=--use-openssl-ca
 WORKDIR /app
 COPY package.json package-lock.json* ./
 RUN npm ci --omit=dev && npm cache clean --force
diff --git a/package-lock.json b/package-lock.json
index e815e0d..34f3930 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "ghost-github-portfolio",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "ghost-github-portfolio",
-      "version": "0.4.0",
+      "version": "0.4.1",
       "license": "GPL-3.0-or-later",
       "dependencies": {
         "commander": "^13.1.0",
diff --git a/package.json b/package.json
index f1648c2..4ba19e7 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ghost-github-portfolio",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Write your most starred GitHub repositories to a Ghost page as a grid of cards, through the Ghost Admin API.",
   "type": "module",
   "bin": {