diff --git a/.github/workflows/dapp-deploy.yml b/.github/workflows/dapp-deploy.yml
index 947d1bc..f4ff491 100644
--- a/.github/workflows/dapp-deploy.yml
+++ b/.github/workflows/dapp-deploy.yml
@@ -75,9 +75,9 @@ jobs:
         /etc/resolv.conf
       binary-fs: true
       fs-dir: /app
-      heap: 7G
+      heap: 1G
       dlopen: 1
-      mprotect: 1
+      mprotect: 0
     secrets:
       docker-username: ${{ secrets.DOCKERHUB_USERNAME }}
       docker-password: ${{ secrets.DOCKERHUB_PAT }}
diff --git a/dapp/Dockerfile b/dapp/Dockerfile
index be23f33..2f0040a 100644
--- a/dapp/Dockerfile
+++ b/dapp/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:20.19-alpine3.22
+FROM node:22-alpine3.22
 WORKDIR /app
 COPY package*.json ./
 RUN npm ci --production
diff --git a/deployment-dapp/src/singleFunction/deployApp.ts b/deployment-dapp/src/singleFunction/deployApp.ts
index 827b965..f551368 100644
--- a/deployment-dapp/src/singleFunction/deployApp.ts
+++ b/deployment-dapp/src/singleFunction/deployApp.ts
@@ -32,7 +32,7 @@ export const deployApp = async ({
     framework: 'SCONE' as any, // workaround framework not auto capitalized
     version: `v${sconifyVersion.split('.').slice(0, 2).join('.')}`, // extracts "vX.Y" from "X.Y.Z-vN" format (e.g., "5.9.1-v16" → "v5.9")
     entrypoint: 'node --disable-wasm-trap-handler /app/app.js',
-    heapSize: 7516192768,
+    heapSize: 1073741824, // 1G
     fingerprint,
   };
   const app = {