diff --git a/Dockerfile b/Dockerfile
index 9e91f9c2..1d8f739c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -168,7 +168,9 @@ RUN --mount=type=cache,target=/root/.cache/pip \
     # if not version is set, it will install the 3.11.0 version which, seems that does not have the h5py dependencies \
     # for arm yet.
     pip install h5py==3.10.0 && \
-    pip install tensorflow
+    # Install tensorflow 2.16 to enforce keras >3.9.0
+    # Fixes CVE-2025-1550
+    pip install tensorflow~=2.16
 
 USER ${USER}