diff --git a/.github/workflows/docker-hub.yml b/.github/workflows/docker-hub.yml
index 5c7039f56..a7de9412b 100644
--- a/.github/workflows/docker-hub.yml
+++ b/.github/workflows/docker-hub.yml
@@ -79,8 +79,7 @@ jobs:
       file: src/yhub-server/Dockerfile
       target: yhub
       should_push: ${{ github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'preview') }}
-      # no docker_user: the image defaults to uid 1000, the `node` user the
-      # base image already declares in /etc/passwd
+      docker_user: 1000
 
   notify-argocd:
     needs:
diff --git a/src/yhub-server/Dockerfile b/src/yhub-server/Dockerfile
index 7ceda9e4c..422c94a17 100644
--- a/src/yhub-server/Dockerfile
+++ b/src/yhub-server/Dockerfile
@@ -1,5 +1,12 @@
-# trixie for glibc >= 2.38 — uws prebuilt binaries reject bookworm's 2.36
-FROM node:22-trixie AS base
+# trixie for glibc >= 2.38 — uws prebuilt binaries reject bookworm's 2.36.
+# slim: the full image ships compilers, imagemagick, mariadb... that the server
+# never uses and that the vulnerability scan of the CI reports.
+FROM node:22-trixie-slim AS base
+
+# Upgrade system packages to install security updates
+RUN apt-get update && \
+  apt-get upgrade -y && \
+  rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
@@ -48,7 +55,13 @@ RUN yarn build
 # ---- Production image ----
 FROM base AS yhub
 
-RUN yarn install --frozen-lockfile --production
+# the cache is cleaned in the same layer: it keeps a copy of every package of
+# the lockfile, the development ones included
+RUN yarn install --frozen-lockfile --production && \
+  yarn cache clean
+
+# npm is not needed at runtime and bundles its own, rarely updated, dependencies
+RUN rm -rf /usr/local/bin/npm /usr/local/bin/npx /usr/local/lib/node_modules/npm
 
 COPY --from=yhub-builder /app/dist ./dist