diff --git a/Dockerfile.web b/Dockerfile.web
index da69071..b84d0a4 100644
--- a/Dockerfile.web
+++ b/Dockerfile.web
@@ -8,6 +8,9 @@ COPY web ./web
 RUN node web/build.mjs /dist
 
 FROM caddy:2
+# caddy:2's Alpine ships curl, which nothing here runs (no healthcheck since #218): out, so a
+# curl flaw such as CVE-2026-92392 has nothing to reach in a container facing the internet (#237).
+RUN apk del --no-cache curl
 COPY web/Caddyfile /etc/caddy/Caddyfile
 COPY --from=build /dist /srv
 EXPOSE 8080
diff --git a/web/CHANGELOG.md b/web/CHANGELOG.md
index 95ff462..efd6dcd 100644
--- a/web/CHANGELOG.md
+++ b/web/CHANGELOG.md
@@ -11,6 +11,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- The ipx-web image no longer carries curl, which Caddy's base image shipped and nothing used: 8.22.0 there is affected by CVE-2026-92392 (#237).
+
 ### Fixed
 
 - The refresh buttons turn from the moment they are pressed until the scan they asked for has finished, smoothly, instead of jerking back upright between one feed and the next (#231, #233).