diff --git a/PROJECT_STATE.md b/PROJECT_STATE.md
index 3d1225a..02daac3 100644
--- a/PROJECT_STATE.md
+++ b/PROJECT_STATE.md
@@ -1,5 +1,15 @@
 # Project state
 
+## M46 — refresh vulnerable web runtime base (2026-08-21)
+
+- The production image gate found fixed HIGH/CRITICAL Alpine vulnerabilities in the
+  previously pinned Nginx 1.27 runtime, after all functional production checks passed.
+- Refreshed the official runtime to Nginx 1.30.4 on Alpine 3.24.1 and pinned its immutable
+  multi-platform digest `sha256:97d490c12ba55b4946b01546d1c3ed324e8d41ab1c9fcb2a616aa470620e5b46`.
+  Trivy 0.70 reports zero fixed HIGH/CRITICAL findings for that base.
+- Exact next action: build and scan the complete web image, commit and push M46, deploy
+  the exact revision, then repeat production image and browser acceptance gates.
+
 ## M45 — authenticate production metrics scraping (2026-08-21)
 
 - Pre-deployment inspection confirmed production protects `/metrics` with a non-empty
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index 796bd3b..cf38a80 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -10,7 +10,7 @@ ARG VITE_API_BASE_URL=""
 ENV VITE_API_BASE_URL=$VITE_API_BASE_URL
 RUN npm run build
 
-FROM nginx:1.27-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10
+FROM nginx:1.30.4-alpine@sha256:97d490c12ba55b4946b01546d1c3ed324e8d41ab1c9fcb2a616aa470620e5b46
 ARG VCS_REF=development
 ARG BUILD_DATE=unknown
 LABEL org.opencontainers.image.title="Fleet Ops Web" \