diff --git a/Dockerfile.spa b/Dockerfile.spa
index b99d1440..60bcffe6 100644
--- a/Dockerfile.spa
+++ b/Dockerfile.spa
@@ -1,7 +1,7 @@
 # Compile NTIA ITM to WASM. Pinned to same emsdk as frontend/wasm/itm/Dockerfile.
 # --platform=linux/amd64: emsdk only publishes amd64; WASM output is arch-neutral
 # so QEMU-emulating this stage on arm64 runners is fine.
-FROM --platform=linux/amd64 emscripten/emsdk:6.0.1 AS wasm-build
+FROM --platform=linux/amd64 emscripten/emsdk:6.0.2 AS wasm-build
 
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
     && rm -rf /var/lib/apt/lists/*
diff --git a/Dockerfile.spa.dev b/Dockerfile.spa.dev
index 0f2287dc..f0ceaea7 100644
--- a/Dockerfile.spa.dev
+++ b/Dockerfile.spa.dev
@@ -1,5 +1,5 @@
 # Compile NTIA ITM to WASM (see Dockerfile.spa for details).
-FROM --platform=linux/amd64 emscripten/emsdk:6.0.1 AS wasm-build
+FROM --platform=linux/amd64 emscripten/emsdk:6.0.2 AS wasm-build
 
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
     && rm -rf /var/lib/apt/lists/*
diff --git a/frontend/wasm/itm/Dockerfile b/frontend/wasm/itm/Dockerfile
index 41b59f36..a3f47847 100644
--- a/frontend/wasm/itm/Dockerfile
+++ b/frontend/wasm/itm/Dockerfile
@@ -7,7 +7,7 @@
 # The container runs fetch-vendor.sh + build.sh, then copies artifacts
 # (itm.js and itm.d.ts) out to the volume mount.
 
-FROM emscripten/emsdk:6.0.1 AS builder
+FROM emscripten/emsdk:6.0.2 AS builder
 
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
     && rm -rf /var/lib/apt/lists/*