diff --git a/packages/http-client-csharp/playground-server/Dockerfile b/packages/http-client-csharp/playground-server/Dockerfile
index 953ffae59d5..9a39f84e6e3 100644
--- a/packages/http-client-csharp/playground-server/Dockerfile
+++ b/packages/http-client-csharp/playground-server/Dockerfile
@@ -1,6 +1,14 @@
 # Build from the http-client-csharp package root:
 #   docker build -f playground-server/Dockerfile -t csharp-playground-server .
-FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
+# cspell:ignore libbrotli
+FROM mcr.microsoft.com/dotnet/sdk:10.0-noble AS base
+
+# The SDK base can contain libbrotli1 without the CVE-2026-111497 fix.
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends --only-upgrade libbrotli1 \
+  && rm -rf /var/lib/apt/lists/*
+
+FROM base AS build
 WORKDIR /src
 
 # Build the generator (populates dist/generator/)
@@ -18,7 +26,7 @@ RUN dotnet publish playground-server -c Release -o /app --no-restore
 RUN cp -r dist/generator /app/generator
 
 # Need full SDK (not just aspnet) because the server spawns `dotnet` to run the generator DLL
-FROM mcr.microsoft.com/dotnet/sdk:10.0 AS runtime
+FROM base AS runtime
 WORKDIR /app
 COPY --from=build /app .