diff --git a/.github/workflows/update-lambda-extension.yml b/.github/workflows/update-lambda-extension.yml
index 3b0dde97c21..c62e39ad8c0 100644
--- a/.github/workflows/update-lambda-extension.yml
+++ b/.github/workflows/update-lambda-extension.yml
@@ -68,6 +68,7 @@ jobs:
             "utils/build/docker/python_lambda/runtime.base.Dockerfile" \
             "utils/build/docker/java_lambda/runtime.base.Dockerfile" \
             "utils/build/docker/ruby_lambda/runtime.base.Dockerfile" \
+            "utils/build/docker/nodejs_lambda/runtime.base.Dockerfile" \
             "utils/build/docker/base-images.lock.json" \
             "mirror_images.yaml" \
             "mirror_images.lock.yaml" \
@@ -129,7 +130,7 @@ jobs:
           else
             gh pr create \
               --title "Update pinned lambda extension version" \
-              --body "Automated update of the pinned public.ecr.aws/datadog/lambda-extension version used by the python_lambda, java_lambda, and ruby_lambda base images" \
+              --body "Automated update of the pinned public.ecr.aws/datadog/lambda-extension version used by the python_lambda, java_lambda, ruby_lambda, and nodejs_lambda base images" \
               --head "$BRANCH_NAME" \
               --base main
           fi
diff --git a/mirror_images.lock.yaml b/mirror_images.lock.yaml
index 0221bbcd91b..be0960adb15 100644
--- a/mirror_images.lock.yaml
+++ b/mirror_images.lock.yaml
@@ -286,6 +286,10 @@ images:
     digest: sha256:128b7524cde00a739246166feef66b0d512388005dc125b0f11034555a8b6a70
     target: registry.ddbuild.io/system-tests/mirror/datadog/system-tests:nextjs.base-95582a903467
     tag: nextjs.base-95582a903467
+  datadog/system-tests:nodejs-lambda-runtime.base-f7f78c7298cf:
+    digest: sha256:6f2d40e78bc96937010874e2b7f23ef9effb5e087c0cdf674f9b1ca0bcb631a8
+    target: registry.ddbuild.io/system-tests/mirror/datadog/system-tests:nodejs-lambda-runtime.base-f7f78c7298cf
+    tag: nodejs-lambda-runtime.base-f7f78c7298cf
   datadog/system-tests:nodejs_buddy-v1:
     digest: sha256:71d124f74d4d7ac706f1afa8d5950864e1e931ec3b511f540b49eb6328c0338e
     target: registry.ddbuild.io/system-tests/mirror/datadog/system-tests:nodejs_buddy-v1
diff --git a/mirror_images.yaml b/mirror_images.yaml
index fe8ccc19bb0..9359a7755f2 100644
--- a/mirror_images.yaml
+++ b/mirror_images.yaml
@@ -79,6 +79,7 @@
 - "datadog/system-tests:java_buddy-v1"
 - "datadog/system-tests:lambda-proxy-v1"
 - "datadog/system-tests:nextjs.base-95582a903467"
+- "datadog/system-tests:nodejs-lambda-runtime.base-f7f78c7298cf"
 - "datadog/system-tests:nodejs_buddy-v1"
 - "datadog/system-tests:openai-py.base-b4fd56aee3f2"
 - "datadog/system-tests:php-fpm-7.0.base-137961f277f1"
diff --git a/utils/build/docker/base-images.lock.json b/utils/build/docker/base-images.lock.json
index f68ab916cd7..7efd5d1247c 100644
--- a/utils/build/docker/base-images.lock.json
+++ b/utils/build/docker/base-images.lock.json
@@ -6,6 +6,7 @@
     "system_tests_base_nodejs_express4_typescript": "datadog/system-tests:express4-typescript.base-eb800c09d602",
     "system_tests_base_nodejs_express5": "datadog/system-tests:express5.base-6eecdb28aed2",
     "system_tests_base_nodejs_fastify": "datadog/system-tests:fastify.base-bce27c61b3f5",
+    "system_tests_base_nodejs_lambda_nodejs_lambda_runtime": "datadog/system-tests:nodejs-lambda-runtime.base-f7f78c7298cf",
     "system_tests_base_nodejs_nextjs": "datadog/system-tests:nextjs.base-95582a903467",
     "system_tests_base_php_apache_mod_7_0": "datadog/system-tests:apache-mod-7.0.base-d171f9d9cd49",
     "system_tests_base_php_apache_mod_7_0_zts": "datadog/system-tests:apache-mod-7.0-zts.base-c32a9f8fabfa",
diff --git a/utils/build/docker/nodejs_lambda/docker-bake.hcl b/utils/build/docker/nodejs_lambda/docker-bake.hcl
new file mode 100644
index 00000000000..e93f5245e31
--- /dev/null
+++ b/utils/build/docker/nodejs_lambda/docker-bake.hcl
@@ -0,0 +1,21 @@
+# Docker Buildx bake file for nodejs_lambda base images
+#
+# `context` is always this directory: base image Dockerfiles only COPY files from
+# here, so paths in the Dockerfile are relative to it (see build_base_images.py,
+# which derives base_image_dependencies from these COPY instructions).
+
+group "default" {
+  targets = [
+    "runtime",
+  ]
+}
+
+target "_common" {
+  context = "."
+}
+
+target "runtime" {
+  inherits   = ["_common"]
+  dockerfile = "runtime.base.Dockerfile"
+  tags       = ["datadog/system-tests:nodejs-lambda-runtime.base"]
+}
diff --git a/utils/build/docker/nodejs_lambda/install_datadog_lambda.sh b/utils/build/docker/nodejs_lambda/install_datadog_lambda.sh
index 7ecc43ac725..cb3a297d13d 100755
--- a/utils/build/docker/nodejs_lambda/install_datadog_lambda.sh
+++ b/utils/build/docker/nodejs_lambda/install_datadog_lambda.sh
@@ -22,13 +22,12 @@ else
     esac
     echo "Detected Node.js major: ${NODE_MAJOR}, using layer runtime version: ${NODE_VERSION}"
 
-    LATEST_TAG=$(curl -fsSL -H "Accept: application/vnd.github.v3+json" \
-        https://api.github.com/repos/DataDog/datadog-lambda-js/releases/latest \
-        | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"//;s/".*//')
-    echo "Latest release tag: ${LATEST_TAG}"
-
+    # Resolves directly to the latest release's asset (a github.com redirect), unlike
+    # api.github.com/.../releases/latest which needs a separate call to get the tag name
+    # first and hits that API's much lower unauthenticated rate limit (60/hour/IP).
+    # python_lambda and ruby_lambda's install scripts use the same shortcut.
     ZIP_NAME="datadog_lambda_node${NODE_VERSION}.zip"
-    DOWNLOAD_URL="https://github.com/DataDog/datadog-lambda-js/releases/download/${LATEST_TAG}/${ZIP_NAME}"
+    DOWNLOAD_URL="https://github.com/DataDog/datadog-lambda-js/releases/latest/download/${ZIP_NAME}"
     echo "Downloading ${DOWNLOAD_URL}"
     curl -fsSLO "${DOWNLOAD_URL}"
 
diff --git a/utils/build/docker/nodejs_lambda/nodejs-alb-multi.Dockerfile b/utils/build/docker/nodejs_lambda/nodejs-alb-multi.Dockerfile
index d5d189e148a..52ba85e1754 100644
--- a/utils/build/docker/nodejs_lambda/nodejs-alb-multi.Dockerfile
+++ b/utils/build/docker/nodejs_lambda/nodejs-alb-multi.Dockerfile
@@ -1,10 +1,4 @@
-FROM public.ecr.aws/lambda/nodejs:18
-
-RUN yum install -y unzip findutils socat && yum clean all
-
-# Add the Datadog Extension
-RUN mkdir -p /opt/extensions
-COPY --from=public.ecr.aws/datadog/lambda-extension:latest /opt/. /opt/
+FROM system_tests_base_nodejs_lambda_nodejs_lambda_runtime
 
 COPY utils/build/docker/nodejs_lambda/install_datadog_lambda.sh binaries* /binaries/
 RUN chmod +x /binaries/install_datadog_lambda.sh && /binaries/install_datadog_lambda.sh
diff --git a/utils/build/docker/nodejs_lambda/nodejs-alb.Dockerfile b/utils/build/docker/nodejs_lambda/nodejs-alb.Dockerfile
index bb0e74b1fa7..30dd76bb824 100644
--- a/utils/build/docker/nodejs_lambda/nodejs-alb.Dockerfile
+++ b/utils/build/docker/nodejs_lambda/nodejs-alb.Dockerfile
@@ -1,10 +1,4 @@
-FROM public.ecr.aws/lambda/nodejs:18
-
-RUN yum install -y unzip findutils socat && yum clean all
-
-# Add the Datadog Extension
-RUN mkdir -p /opt/extensions
-COPY --from=public.ecr.aws/datadog/lambda-extension:latest /opt/. /opt/
+FROM system_tests_base_nodejs_lambda_nodejs_lambda_runtime
 
 COPY utils/build/docker/nodejs_lambda/install_datadog_lambda.sh binaries* /binaries/
 RUN chmod +x /binaries/install_datadog_lambda.sh && /binaries/install_datadog_lambda.sh
diff --git a/utils/build/docker/nodejs_lambda/nodejs-apigw-http.Dockerfile b/utils/build/docker/nodejs_lambda/nodejs-apigw-http.Dockerfile
index b57a0e362af..c66cee8069d 100644
--- a/utils/build/docker/nodejs_lambda/nodejs-apigw-http.Dockerfile
+++ b/utils/build/docker/nodejs_lambda/nodejs-apigw-http.Dockerfile
@@ -1,10 +1,4 @@
-FROM public.ecr.aws/lambda/nodejs:18
-
-RUN yum install -y unzip findutils socat && yum clean all
-
-# Add the Datadog Extension
-RUN mkdir -p /opt/extensions
-COPY --from=public.ecr.aws/datadog/lambda-extension:latest /opt/. /opt/
+FROM system_tests_base_nodejs_lambda_nodejs_lambda_runtime
 
 COPY utils/build/docker/nodejs_lambda/install_datadog_lambda.sh binaries* /binaries/
 RUN chmod +x /binaries/install_datadog_lambda.sh && /binaries/install_datadog_lambda.sh
diff --git a/utils/build/docker/nodejs_lambda/nodejs-apigw-rest.Dockerfile b/utils/build/docker/nodejs_lambda/nodejs-apigw-rest.Dockerfile
index 3175afcbc95..9b2bb60871c 100644
--- a/utils/build/docker/nodejs_lambda/nodejs-apigw-rest.Dockerfile
+++ b/utils/build/docker/nodejs_lambda/nodejs-apigw-rest.Dockerfile
@@ -1,10 +1,4 @@
-FROM public.ecr.aws/lambda/nodejs:18
-
-RUN yum install -y unzip findutils socat && yum clean all
-
-# Add the Datadog Extension
-RUN mkdir -p /opt/extensions
-COPY --from=public.ecr.aws/datadog/lambda-extension:latest /opt/. /opt/
+FROM system_tests_base_nodejs_lambda_nodejs_lambda_runtime
 
 COPY utils/build/docker/nodejs_lambda/install_datadog_lambda.sh binaries* /binaries/
 RUN chmod +x /binaries/install_datadog_lambda.sh && /binaries/install_datadog_lambda.sh
diff --git a/utils/build/docker/nodejs_lambda/nodejs-function-url.Dockerfile b/utils/build/docker/nodejs_lambda/nodejs-function-url.Dockerfile
index bc4d8f97bc6..93defeadce9 100644
--- a/utils/build/docker/nodejs_lambda/nodejs-function-url.Dockerfile
+++ b/utils/build/docker/nodejs_lambda/nodejs-function-url.Dockerfile
@@ -1,10 +1,4 @@
-FROM public.ecr.aws/lambda/nodejs:18
-
-RUN yum install -y unzip findutils socat && yum clean all
-
-# Add the Datadog Extension
-RUN mkdir -p /opt/extensions
-COPY --from=public.ecr.aws/datadog/lambda-extension:latest /opt/. /opt/
+FROM system_tests_base_nodejs_lambda_nodejs_lambda_runtime
 
 COPY utils/build/docker/nodejs_lambda/install_datadog_lambda.sh binaries* /binaries/
 RUN chmod +x /binaries/install_datadog_lambda.sh && /binaries/install_datadog_lambda.sh
diff --git a/utils/build/docker/nodejs_lambda/runtime.base.Dockerfile b/utils/build/docker/nodejs_lambda/runtime.base.Dockerfile
new file mode 100644
index 00000000000..d7f4206233e
--- /dev/null
+++ b/utils/build/docker/nodejs_lambda/runtime.base.Dockerfile
@@ -0,0 +1,10 @@
+FROM public.ecr.aws/lambda/nodejs:18
+
+RUN yum install -y unzip findutils socat && yum clean all
+
+# Add the Datadog Extension
+# Pinned (not :latest): the base-image content hash only covers local build-context
+# files, so a floating tag would freeze silently on first build and never refresh.
+# Bump this manually to pick up newer extension releases.
+RUN mkdir -p /opt/extensions
+COPY --from=public.ecr.aws/datadog/lambda-extension:100 /opt/. /opt/
diff --git a/utils/scripts/update_lambda_extension_version.py b/utils/scripts/update_lambda_extension_version.py
index 2bd9ed0fb3c..216b26ffe88 100755
--- a/utils/scripts/update_lambda_extension_version.py
+++ b/utils/scripts/update_lambda_extension_version.py
@@ -7,8 +7,8 @@
 The extension is pinned (not `:latest`) because the base-image content hash only
 covers local build-context files: a floating tag would freeze silently on the
 image's first build and never refresh (see utils/build/docker/python_lambda/runtime.base.Dockerfile,
-utils/build/docker/java_lambda/runtime.base.Dockerfile, and
-utils/build/docker/ruby_lambda/runtime.base.Dockerfile). This script keeps that pin current.
+utils/build/docker/java_lambda/runtime.base.Dockerfile, utils/build/docker/ruby_lambda/runtime.base.Dockerfile,
+and utils/build/docker/nodejs_lambda/runtime.base.Dockerfile). This script keeps that pin current.
 """
 
 import re
@@ -22,6 +22,7 @@
     REPO_ROOT / "utils" / "build" / "docker" / "python_lambda" / "runtime.base.Dockerfile",
     REPO_ROOT / "utils" / "build" / "docker" / "java_lambda" / "runtime.base.Dockerfile",
     REPO_ROOT / "utils" / "build" / "docker" / "ruby_lambda" / "runtime.base.Dockerfile",
+    REPO_ROOT / "utils" / "build" / "docker" / "nodejs_lambda" / "runtime.base.Dockerfile",
 ]
 
 REGISTRY = "public.ecr.aws"