diff --git a/.gitea/workflows/gateway-build.yml b/.gitea/workflows/gateway-build.yml
index 2e42ec8..3e46ff9 100644
--- a/.gitea/workflows/gateway-build.yml
+++ b/.gitea/workflows/gateway-build.yml
@@ -8,7 +8,7 @@ on:
 env:
   DEPLOY_PATH: /opt/vpn-proxy
   BASE_IMAGE: vpn-proxy-runtime-base:bookworm-slim
-  NODE_BUILD_IMAGE: mirror.gcr.io/library/node:20.19-alpine
+  NODE_BUILD_IMAGE: mirror.gcr.io/library/node:20.19-bookworm
   RUNTIME_BASE_SOURCE_IMAGE: mirror.gcr.io/library/debian:bookworm-slim
   APT_MIRROR: http://mirror.yandex.ru/debian
   APT_SECURITY_MIRROR: http://mirror.yandex.ru/debian-security
@@ -87,8 +87,8 @@ jobs:
             npm test
             npm run build:production
           else
-            if ! docker run --rm "${{ env.NODE_BUILD_IMAGE }}" sh -lc 'command -v npm >/dev/null'; then
-              echo "Cannot validate change: host npm and the Node 20.19 build image are unavailable." >&2
+            if ! docker run --rm "${{ env.NODE_BUILD_IMAGE }}" sh -lc 'command -v npm >/dev/null && command -v git >/dev/null && test -x /bin/bash'; then
+              echo "Cannot validate change: host npm and the Node 20.19 build toolchain are unavailable." >&2
               exit 1
             fi
             echo "Host npm not found; validating inside ${{ env.NODE_BUILD_IMAGE }}"
diff --git a/src/shared/versions.ts b/src/shared/versions.ts
index 09e56be..09c2cb5 100644
--- a/src/shared/versions.ts
+++ b/src/shared/versions.ts
@@ -1,7 +1,7 @@
 export const HARBOR_VERSIONS = Object.freeze({
   macClient: '0.20.36',
   gatewayClient: '0.21.21',
-  gatewayBackend: '0.21.21',
+  gatewayBackend: '0.21.22',
 });
 
 export interface ParsedVersion {
diff --git a/test/server/compiled-entrypoint.test.js b/test/server/compiled-entrypoint.test.js
index 63b700c..2e86d40 100644
--- a/test/server/compiled-entrypoint.test.js
+++ b/test/server/compiled-entrypoint.test.js
@@ -148,8 +148,8 @@ test('production paths use only the compiled dispatcher', () => {
     assert.doesNotMatch(entrypoint, /\/app\/src/);
   }
   assert.match(workflow, /npm run build:production/);
-  assert.match(workflow, /NODE_BUILD_IMAGE: mirror\.gcr\.io\/library\/node:20\.19-alpine/);
-  assert.match(workflow, /docker run --rm "\$\{\{ env\.NODE_BUILD_IMAGE \}\}" sh -lc 'command -v npm/);
+  assert.match(workflow, /NODE_BUILD_IMAGE: mirror\.gcr\.io\/library\/node:20\.19-bookworm/);
+  assert.match(workflow, /command -v npm[^']+command -v git[^']+test -x \/bin\/bash/);
   assert.doesNotMatch(workflow, /docker image inspect "\$\{\{ env\.NODE_BUILD_IMAGE \}\}"/);
   assert.match(legacyBuild, /npm run build:production && docker build/);
   assert.match(dockerignore, /^dist$/m);