diff --git a/.github/workflows/coolify-release.yml b/.github/workflows/coolify-release.yml
index 9f83302ee9..70bb5d6af5 100644
--- a/.github/workflows/coolify-release.yml
+++ b/.github/workflows/coolify-release.yml
@@ -30,7 +30,8 @@ jobs:
       version: ${{ steps.version.outputs.version }}
     steps:
       - name: Reject releases outside the production branch
-        if: ${{ github.ref_name != 'main' }}
+        # tmp: allow the 4.4.7 security release from fix/v4.4.7
+        if: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'fix/v') }}
         run: |
           echo "Stable releases must run from main, not ${{ github.ref_name }}."
           exit 1
diff --git a/app/Console/Commands/SyncCdn.php b/app/Console/Commands/SyncCdn.php
index 3e7be78b4a..c447c5f726 100644
--- a/app/Console/Commands/SyncCdn.php
+++ b/app/Console/Commands/SyncCdn.php
@@ -312,6 +312,7 @@ class SyncCdn extends Command
         $install_script_location = "$parent_dir/scripts/install.sh";
         $upgrade_script_location = "$parent_dir/scripts/upgrade.sh";
         $upgrade_postgres_script_location = "$parent_dir/scripts/upgrade-postgres.sh";
+        $patch_script_location = "$parent_dir/scripts/patch.sh";
         $production_env_location = "$parent_dir/.env.production";
         $service_template_location = "$parent_dir/templates/$service_template";
         $versions_location = "$parent_dir/$versions";
@@ -346,6 +347,7 @@ class SyncCdn extends Command
                     $install_script_location => 'json/coolify/install.sh',
                     $upgrade_script_location => 'json/coolify/upgrade.sh',
                     $upgrade_postgres_script_location => 'json/coolify/upgrade-postgres.sh',
+                    $patch_script_location => 'json/coolify/patch.sh',
                     $service_template_location => 'json/coolify/service-templates-latest.json',
                 ];
             }
diff --git a/config/constants.php b/config/constants.php
index 4a652fb3b9..ca59b890df 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -5,7 +5,7 @@ $sshCommandTimeout = (int) env('SSH_COMMAND_TIMEOUT', 3600);
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.4.6',
+        'version' => env('COOLIFY_VERSION') ?: '4.4.7',
         'helper_version' => '1.0.17',
         'self_hosted' => env('SELF_HOSTED', true),
         'autoupdate' => env('AUTOUPDATE'),
diff --git a/docker/production/Dockerfile b/docker/production/Dockerfile
index 46d5c40c4a..3b0fc0275c 100644
--- a/docker/production/Dockerfile
+++ b/docker/production/Dockerfile
@@ -1,14 +1,15 @@
 # Versions
-# https://hub.docker.com/r/serversideup/php/tags?name=8.4-fpm-nginx-alpine
-# Pinned: v5 moved user bundles to /etc/s6-overlay/user-bundles.d and breaks startup (#12141)
-ARG SERVERSIDEUP_PHP_VERSION=8.4-fpm-nginx-alpine-v4.5.1
+# Temporary: serversideup/php v4.5.1 (8.4-fpm-nginx-alpine) rebuilt on the patched PHP 8.4 release
+ARG SERVERSIDEUP_PHP_IMAGE=ghcr.io/coollabsio/serversideup-php:8.4-fpm-nginx-alpine-v4.5.1-hotfix
 # https://github.com/cloudflare/cloudflared/releases
-ARG CLOUDFLARED_VERSION=2026.7.3
+ARG CLOUDFLARED_VERSION=2026.10.3
 # https://www.postgresql.org/support/versioning/
 # Note: We are using version 18 of the postgres client (while still using postgres 15 for the postgres server) as version 15 has been removed from Alpine 3.23+ https://pkgs.alpinelinux.org/packages?name=postgresql*-client&branch=v3.23&repo=&arch=x86_64&origin=&flagged=&maintainer=
 ARG POSTGRES_VERSION=18
 # https://nginx.org/en/linux_packages.html
 ARG NGINX_VERSION=1.31.2-r1
+# https://nodejs.org/en/about/previous-releases
+ARG NODE_VERSION=24.22.1
 # https://pecl.php.net/package/uv
 ARG PHP_UV_VERSION=0.3.0
 
@@ -19,7 +20,7 @@ ARG GROUP_ID=9999
 # =================================================================
 # Stage 1: Composer dependencies
 # =================================================================
-FROM serversideup/php:${SERVERSIDEUP_PHP_VERSION} AS base
+FROM ${SERVERSIDEUP_PHP_IMAGE} AS base
 
 USER root
 
@@ -49,10 +50,15 @@ RUN --mount=type=cache,target=/tmp/cache \
 
 USER www-data
 
+# Temporary: the node:24.22.1 multi-arch manifest is not published yet, pull the per-arch image instead
+FROM amd64/node:${NODE_VERSION}-alpine3.24 AS nodejs-amd64
+FROM arm64v8/node:${NODE_VERSION}-alpine3.24 AS nodejs-arm64
+FROM nodejs-${TARGETARCH} AS nodejs
+
 # =================================================================
 # Stage 2: Frontend assets compilation
 # =================================================================
-FROM node:24-alpine AS static-assets
+FROM nodejs AS static-assets
 
 WORKDIR /app
 COPY package*.json vite.config.js postcss.config.cjs ./
@@ -69,12 +75,15 @@ FROM quay.io/minio/aistor/mc:RELEASE.2026-09-06T02-44-40Z AS minio-client
 # =================================================================
 # Stage 4: Terminal dependencies (match the production Node.js ABI and libc)
 # =================================================================
-FROM serversideup/php:${SERVERSIDEUP_PHP_VERSION} AS terminal-dependencies
+FROM ${SERVERSIDEUP_PHP_IMAGE} AS terminal-dependencies
 
 USER root
 
 RUN apk upgrade && \
-    apk add --no-cache nodejs npm make g++ python3
+    apk add --no-cache make g++ python3
+COPY --from=nodejs /usr/local/bin/node /usr/local/bin/node
+COPY --from=nodejs /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/npm
+RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm
 COPY docker/coolify-terminal/package*.json /terminal/
 RUN --mount=type=cache,target=/root/.npm \
     npm ci --prefix /terminal && \
@@ -87,7 +96,7 @@ COPY docker/coolify-terminal/terminal-utils.js /terminal/terminal-utils.js
 # =================================================================
 # Final Stage: Production image
 # =================================================================
-FROM serversideup/php:${SERVERSIDEUP_PHP_VERSION}
+FROM ${SERVERSIDEUP_PHP_IMAGE}
 
 ARG USER_ID
 ARG GROUP_ID
@@ -130,7 +139,7 @@ RUN --mount=type=cache,target=/var/cache/apk \
     apk upgrade && \
     apk add --no-cache \
     postgresql${POSTGRES_VERSION}-client \
-    nodejs \
+    libstdc++ \
     openssh-client \
     git \
     git-lfs \
@@ -189,6 +198,7 @@ COPY --chown=www-data:www-data versions.json ./versions.json
 RUN composer dump-autoload
 
 # Install terminal WebSocket server dependencies
+COPY --from=nodejs /usr/local/bin/node /usr/local/bin/node
 COPY --from=terminal-dependencies --chown=www-data:www-data /terminal /terminal
 
 # Configure Nginx and S6 overlay
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index 1559e29661..be9bea0d60 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.4.6"
+            "version": "4.4.7"
         },
         "nightly": {
             "version": "4.5-rc.1"
diff --git a/tests/Feature/SyncCdnTest.php b/tests/Feature/SyncCdnTest.php
index 00bed238c7..52e0ea8945 100644
--- a/tests/Feature/SyncCdnTest.php
+++ b/tests/Feature/SyncCdnTest.php
@@ -97,6 +97,7 @@ SH);
         'install.sh',
         'upgrade.sh',
         'upgrade-postgres.sh',
+        ...($environment === 'production' ? ['patch.sh'] : []),
         'service-templates-latest.json',
     ];
     $allTargets = array_map(fn (string $file) => "$targetDirectory/$file", $allBasenames);
@@ -179,6 +180,7 @@ it('purges the CDN files from the Cloudflare cache', function (string $environme
             'install.sh',
             'upgrade.sh',
             'upgrade-postgres.sh',
+            ...($environment === 'production' ? ['patch.sh'] : []),
             'service-templates-latest.json',
         ]))->all());
 })->with([
diff --git a/versions.json b/versions.json
index 1559e29661..be9bea0d60 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.4.6"
+            "version": "4.4.7"
         },
         "nightly": {
             "version": "4.5-rc.1"