diff --git a/content/releases/3.breaking-changes/3.version-12.md b/content/releases/3.breaking-changes/3.version-12.md
index 9670a67e..8badaa12 100644
--- a/content/releases/3.breaking-changes/3.version-12.md
+++ b/content/releases/3.breaking-changes/3.version-12.md
@@ -26,6 +26,12 @@ WebSocket connections are now validated against `CORS_ORIGIN`. If you use WebSoc
 
 Upload path validation has been hardened to prevent writes to extension and temporary storage directories. Uploads that previously targeted these protected directories will now be rejected.
 
+### Hardened Docker image and new distroless variant
+
+The published Docker image has been hardened: it now applies outstanding OS-level patches at build time and drops `npm` and `npx` from the runtime. If your setup relies on `npm` or `npx` inside the container (for example, to install extensions at runtime), it will no longer work.
+
+A new distroless Docker Hardened Image (DHI) variant is also published alongside the standard image, under a `-dhi` tag suffix.
+
 ## Version 12.0.0
 
 Jump to: