diff --git a/Dockerfile b/Dockerfile
index 92e08c1..fa0e9c5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,7 +4,7 @@ ARG PHP_VERSION=8.4
 ARG NGINX_VERSION=1.28
 
 ARG ALPINE_VERSION=3.23
-ARG HARDENED_MALLOC_VERSION=16
+ARG HARDENED_MALLOC_VERSION=14
 ARG SNUFFLEUPAGUS_VERSION=0.13.0
 
 ARG UID=1000
@@ -94,8 +94,8 @@ ARG VARIANT=light
 RUN apk --no-cache add build-base git openssh && cd /tmp \
  && wget -q -O - https://github.com/thestinger.keys | while read -r key; do echo "thestinger@github.com $key"; done > allowed_signers \
  && git config --global gpg.ssh.allowedSignersFile /tmp/allowed_signers \
- && git clone --depth 1 --branch ${HARDENED_MALLOC_VERSION} https://github.com/GrapheneOS/hardened_malloc \
- && cd hardened_malloc && git verify-tag $(git describe --tags) \
+ && git clone --depth 1 https://github.com/GrapheneOS/hardened_malloc && cd hardened_malloc \
+ && git checkout refs/tags/${HARDENED_MALLOC_VERSION} && git verify-tag $(git describe --tags) \
  && make CONFIG_NATIVE=${CONFIG_NATIVE} VARIANT=${VARIANT}