diff --git a/Dockerfile b/Dockerfile
index 17cc181..9b96ae3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,7 @@ RUN npm run build
 FROM build AS test
 COPY scripts ./scripts
 COPY examples ./examples
-COPY docker-compose.yml .env.example ./
+COPY docker-compose.yml .env.example Dockerfile ./
 CMD ["npm", "test"]
 
 FROM ${BASE_IMAGE} AS runner
diff --git a/scripts/git-build-deploy.ps1 b/scripts/git-build-deploy.ps1
index 36ba4e7..ddc2fbe 100644
--- a/scripts/git-build-deploy.ps1
+++ b/scripts/git-build-deploy.ps1
@@ -69,13 +69,15 @@ image_tag="production-${short_sha}"
 local_commit="localhost:${REGISTRY_HOST##*:}/${IMAGE_NAME}:${image_tag}"
 local_latest="localhost:${REGISTRY_HOST##*:}/${IMAGE_NAME}:production-latest"
 remote_commit="${REGISTRY_HOST}/${IMAGE_NAME}:${image_tag}"
-base_image="localhost:${REGISTRY_HOST##*:}/yyd-base/node:22-alpine"
+base_image="$(sed -n 's/^ARG BASE_IMAGE=//p' Dockerfile)"
+[[ "$base_image" =~ ^node:[0-9]+\.[0-9]+\.[0-9]+-alpine@sha256:[0-9a-f]{64}$ ]] \
+  || fail 'Dockerfile 必须固定已验收的官方 Node 镜像和摘要'
 
 log "构建提交 ${commit_sha}"
 docker pull "$base_image" >/dev/null \
-  || fail "内部基础镜像不可用: $base_image"
+  || fail "固定基础镜像不可用: $base_image"
 docker pull "$local_latest" >/dev/null 2>&1 || true
-build_args=(--build-arg "BASE_IMAGE=$base_image")
+build_args=(--build-arg "VCS_REF=$commit_sha")
 if docker image inspect "$local_latest" >/dev/null 2>&1; then
   build_args+=(--cache-from "$local_latest")
 fi
diff --git a/src/__tests__/deployment.test.ts b/src/__tests__/deployment.test.ts
index 16def7b..ee98920 100644
--- a/src/__tests__/deployment.test.ts
+++ b/src/__tests__/deployment.test.ts
@@ -9,6 +9,11 @@ test('生产发布面透传免登配置并保留已有项目 login', () => {
   const gitDeploy = readFileSync('scripts/git-build-deploy.ps1', 'utf8')
   const testRunner = readFileSync('scripts/run-tests.mjs', 'utf8')
   const packageJson = JSON.parse(readFileSync('package.json', 'utf8'))
+  const dockerfile = readFileSync('Dockerfile', 'utf8')
+  assert.match(dockerfile, /^ARG BASE_IMAGE=node:22\.23\.4-alpine@sha256:[a-f0-9]{64}$/m)
+  assert.match(gitDeploy, /s\/\^ARG BASE_IMAGE=\/\/p/)
+  assert.match(gitDeploy, /build_args=\(--build-arg "VCS_REF=\$commit_sha"\)/)
+  assert.doesNotMatch(gitDeploy, /--build-arg "BASE_IMAGE=/)
   for (const key of [
     'DINGTALK_CORP_ID',
     'YYD_NOTIFICATION_PUBLIC_BASE_URL',