diff --git a/Dockerfile.coverage b/Dockerfile.coverage
index abc840b0..8438cf48 100644
--- a/Dockerfile.coverage
+++ b/Dockerfile.coverage
@@ -3,7 +3,7 @@
 # Node via tsx + sharp. Writes tiles to a shared volume that meshinfo serves.
 
 # Stage 1: compile NTIA ITM to WASM (same as the SPA image).
-FROM --platform=linux/amd64 emscripten/emsdk:6.0.11 AS wasm-build
+FROM --platform=linux/amd64 emscripten/emsdk:6.0.12 AS wasm-build
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 WORKDIR /itm
diff --git a/Dockerfile.spa b/Dockerfile.spa
index 7c11707b..c0e5ccbc 100644
--- a/Dockerfile.spa
+++ b/Dockerfile.spa
@@ -1,7 +1,7 @@
 # Compile NTIA ITM to WASM. Pinned to same emsdk as frontend/wasm/itm/Dockerfile.
 # --platform=linux/amd64: emsdk only publishes amd64; WASM output is arch-neutral
 # so QEMU-emulating this stage on arm64 runners is fine.
-FROM --platform=linux/amd64 emscripten/emsdk:6.0.11 AS wasm-build
+FROM --platform=linux/amd64 emscripten/emsdk:6.0.12 AS wasm-build
 
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
     && rm -rf /var/lib/apt/lists/*
diff --git a/Dockerfile.spa.dev b/Dockerfile.spa.dev
index 79f589fd..188bf1bb 100644
--- a/Dockerfile.spa.dev
+++ b/Dockerfile.spa.dev
@@ -1,5 +1,5 @@
 # Compile NTIA ITM to WASM (see Dockerfile.spa for details).
-FROM --platform=linux/amd64 emscripten/emsdk:6.0.11 AS wasm-build
+FROM --platform=linux/amd64 emscripten/emsdk:6.0.12 AS wasm-build
 
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
     && rm -rf /var/lib/apt/lists/*
diff --git a/frontend/wasm/itm/Dockerfile b/frontend/wasm/itm/Dockerfile
index 74820f55..afa2f023 100644
--- a/frontend/wasm/itm/Dockerfile
+++ b/frontend/wasm/itm/Dockerfile
@@ -7,7 +7,7 @@
 # The container runs fetch-vendor.sh + build.sh, then copies artifacts
 # (itm.js and itm.d.ts) out to the volume mount.
 
-FROM emscripten/emsdk:6.0.11 AS builder
+FROM emscripten/emsdk:6.0.12 AS builder
 
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
     && rm -rf /var/lib/apt/lists/*