diff --git a/Dockerfile b/Dockerfile
index aec1232..4b83715 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Use official Python runtime pinned by digest
-FROM python:3.14-slim-bookworm@sha256:a70519002c49552ea0a853de47599cf40479b001bd7a624f1112eaf44dcaccc7 AS builder
+FROM python:3.14-slim-bookworm@sha256:4ff4b92a68355dbdb52584ab3391dff8d371a61d4e063468bfd0130e3189c6d9 AS builder
 
 WORKDIR /build
 
@@ -11,7 +11,7 @@ RUN apt-get update \
 COPY requirements.txt /build/requirements.txt
 RUN pip wheel --no-cache-dir --wheel-dir /build/wheels -r /build/requirements.txt
 
-FROM python:3.14-slim-bookworm@sha256:a70519002c49552ea0a853de47599cf40479b001bd7a624f1112eaf44dcaccc7
+FROM python:3.14-slim-bookworm@sha256:4ff4b92a68355dbdb52584ab3391dff8d371a61d4e063468bfd0130e3189c6d9
 
 WORKDIR /app
 
diff --git a/scripts/smoke.sh b/scripts/smoke.sh
index 26233bb..bf94186 100755
--- a/scripts/smoke.sh
+++ b/scripts/smoke.sh
@@ -242,11 +242,12 @@ assert_json_key_equals "$retry_body" "strategy_used" "get" || fail "Expected fin
 assert_json_key_equals "$retry_body" "error_category" "navigation_error" || fail "Expected navigation_error category"
 
 echo "[smoke] Checking per-request isolation (no cookie leak)"
-set_cookie_response="$(http_post "/scrape" '{"url":"https://httpbin.org/cookies/set?isotest=1","navigation_mode":"get","max_retries":0}')"
+# Use httpbingo (httpbin.org is often down). headless=true avoids xvfb hangs on the Set-Cookie redirect.
+set_cookie_response="$(http_post "/scrape" '{"url":"https://httpbingo.org/cookies/set?isotest=1","navigation_mode":"get","max_retries":0,"headless":true}')"
 set_cookie_code="$(echo "$set_cookie_response" | tail -n1)"
 [[ "$set_cookie_code" == "200" ]] || fail "Expected cookie set scrape 200, got ${set_cookie_code}"
 
-check_cookie_response="$(http_post "/scrape" '{"url":"https://httpbin.org/cookies","navigation_mode":"get","max_retries":0}')"
+check_cookie_response="$(http_post "/scrape" '{"url":"https://httpbingo.org/cookies","navigation_mode":"get","max_retries":0,"headless":true}')"
 check_cookie_body="$(echo "$check_cookie_response" | sed '$d')"
 check_cookie_code="$(echo "$check_cookie_response" | tail -n1)"
 [[ "$check_cookie_code" == "200" ]] || fail "Expected cookie check scrape 200, got ${check_cookie_code}"