diff --git a/base.Dockerfile b/base.Dockerfile
index 3a367e1..ca91d21 100644
--- a/base.Dockerfile
+++ b/base.Dockerfile
@@ -1,11 +1,26 @@
-FROM python:3.10 AS beer_base_image
+FROM python:3.14.10-slim AS beer_base_image
 
 WORKDIR /beer_data
 
 COPY requirements.txt .
 
-RUN apt-get update -y && apt-get upgrade -y && apt-get install -y libsasl2-dev python-dev-is-python3 libldap2-dev libssl-dev
+# The runtime dependencies (flask, flask-wtf, waitress, pymongo, requests) all
+# ship as wheels for 3.14, so no compiler toolchain is needed.  The old image
+# installed libsasl2-dev, python-dev-is-python3, libldap2-dev and libssl-dev
+# for packages that are no longer in the dependency list.
+#
+# The Python version matters:
+#   - pymongo 4.19 requires Python >= 3.11, so the base image could not stay
+#     on 3.10 once the requirements were pinned.
+#   - 3.14 is a stable release (first released 2025-10-07, in its bugfix
+#     phase until 2030-10), so the image is not carrying the CVEs fixed in
+#     3.11, 3.12 and 3.13.
+#   - The patch version is pinned rather than the floating `3.14-slim` tag so
+#     a rebuild is reproducible and does not silently pick up a base image
+#     change.
+RUN pip install --upgrade pip --no-cache-dir
 
-RUN pip install --upgrade pip
+RUN pip --default-timeout=1000 install --no-cache-dir -r requirements.txt
 
-RUN pip --default-timeout=1000 install -r requirements.txt
+# Fail the build if the interpreter is not the one the image claims.
+RUN python -c "import sys; assert sys.version_info[:2] == (3, 14), sys.version"
diff --git a/flask.Dockerfile b/flask.Dockerfile
index 2cbd69c..e242e30 100644
--- a/flask.Dockerfile
+++ b/flask.Dockerfile
@@ -8,6 +8,12 @@ ADD src /beer_data/src
 # (``import brewing``), so that directory is the working directory.
 WORKDIR /beer_data/src/flask
 
+# Run as an unprivileged user.  The app only needs to read its own source
+# and talk to Mongo over the network — it writes no files — so it does not
+# need to be root.
+RUN useradd --system --create-home --home-dir /home/beer --shell /usr/sbin/nologin beer \
+    && chown -R beer:beer /beer_data
+
 # The app is served by waitress, not the Flask development server.
 # FLASK_DEBUG stays OFF: the old entrypoint ran the Werkzeug debugger in
 # production, which exposes an interactive console on any unhandled error.
@@ -21,6 +27,8 @@ ENV PORT=5000
 # session-signing key.
 # ENV SECRET_KEY=...
 
+USER beer
+
 EXPOSE 5000
 
 ENTRYPOINT ["python", "-m", "waitress", "--listen=0.0.0.0:5000", "--call", "beer_data:create_app"]