diff --git a/.github/workflows/scip-docker.yml b/.github/workflows/scip-docker.yml
index 7422f03f3..69353f064 100644
--- a/.github/workflows/scip-docker.yml
+++ b/.github/workflows/scip-docker.yml
@@ -28,12 +28,14 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-node-
       - run: npm install
-      - run: cd ./packages/pyright-scip/ && npm install && npm run build
+      # npm pack builds the package and creates the tarball Dockerfile.autoindex installs.
+      - run: cd ./packages/pyright-scip/ && npm install && npm pack
       - uses: docker/setup-buildx-action@v2
       - name: Build Dockerfile
         id: docker_build_autoindex
         uses: docker/build-push-action@v4
         with:
+          context: .
           file: Dockerfile.autoindex
           push: false
           tags: |
diff --git a/.github/workflows/scip-release.yml b/.github/workflows/scip-release.yml
index 36a7ecf62..0e409e402 100644
--- a/.github/workflows/scip-release.yml
+++ b/.github/workflows/scip-release.yml
@@ -18,7 +18,8 @@ jobs:
         with:
           node-version: 24
       - run: npm install
-      - run: cd ./packages/pyright-scip/ && npm install && npm run build
+      # npm pack builds the package and creates the tarball Dockerfile.autoindex installs.
+      - run: cd ./packages/pyright-scip/ && npm install && npm pack
       - run: cd ./packages/pyright-scip/ && npm publish --access public
       - name: Login to DockerHub
         uses: docker/login-action@v2
@@ -29,6 +30,7 @@ jobs:
         id: docker_build_autoindex
         uses: docker/build-push-action@v4
         with:
+          context: .
           file: Dockerfile.autoindex
           push: true
           tags: |
diff --git a/Dockerfile.autoindex b/Dockerfile.autoindex
index 668da042f..c93b7dc39 100644
--- a/Dockerfile.autoindex
+++ b/Dockerfile.autoindex
@@ -3,6 +3,10 @@ FROM nikolaik/python-nodejs:python3.11-nodejs24-alpine@sha256:2db8a57a186758d0ca
 # ca-certificates 20261020-r0 distrusts the compromised eMudhra intermediates;
 # the base image ships an older version.
 RUN apk add --no-cache --upgrade git bash curl 'ca-certificates>=20261020-r0' 'ca-certificates-bundle>=20261020-r0'
-RUN npm install -g @sourcegraph/scip-python @sourcegraph/src
+# Install scip-python from this checkout (run `npm pack` in packages/pyright-scip
+# first), not from npm: npm holds new versions for malware scanning, so a
+# release build would otherwise install the previous version.
+COPY packages/pyright-scip/sourcegraph-scip-python-*.tgz /tmp/scip-python.tgz
+RUN npm install -g /tmp/scip-python.tgz @sourcegraph/src && rm /tmp/scip-python.tgz
 
 CMD ["/bin/sh"]
diff --git a/packages/pyright-scip/CHANGELOG.md b/packages/pyright-scip/CHANGELOG.md
index ff3e4e872..75bf52fd9 100644
--- a/packages/pyright-scip/CHANGELOG.md
+++ b/packages/pyright-scip/CHANGELOG.md
@@ -1,5 +1,11 @@
 # scip-python CHANGELOG
 
+## v0.6.8
+
+- The autoindex Docker image now installs scip-python built from the
+  release commit instead of from npm. The v0.6.7 image was built while
+  npm was still scanning 0.6.7, so it contains scip-python 0.6.6.
+
 ## v0.6.7
 
 - Updates the autoindex Docker image base to Alpine 3.24, Node 24 and
diff --git a/packages/pyright-scip/package-lock.json b/packages/pyright-scip/package-lock.json
index 27cf8765e..aa499ea33 100644
--- a/packages/pyright-scip/package-lock.json
+++ b/packages/pyright-scip/package-lock.json
@@ -1,12 +1,12 @@
 {
     "name": "@sourcegraph/scip-python",
-    "version": "0.6.7",
+    "version": "0.6.8",
     "lockfileVersion": 2,
     "requires": true,
     "packages": {
         "": {
             "name": "@sourcegraph/scip-python",
-            "version": "0.6.7",
+            "version": "0.6.8",
             "license": "MIT",
             "dependencies": {
                 "@iarna/toml": "^2.2.5",
diff --git a/packages/pyright-scip/package.json b/packages/pyright-scip/package.json
index c3cdd35d5..ffff22c58 100644
--- a/packages/pyright-scip/package.json
+++ b/packages/pyright-scip/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@sourcegraph/scip-python",
-    "version": "0.6.7",
+    "version": "0.6.8",
     "description": "SCIP indexer for Python",
     "main": "index.js",
     "scripts": {