diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 700fcbb9..9b6544b8 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -34,7 +34,7 @@ jobs:
           --health-timeout 5s
           --health-retries 20
       valkey:
-        image: docker.io/valkey/valkey:8@sha256:640c5e62cea04b6d6f2084232651d0cc70362d31f4f805e7be94dbed6855e8f2
+        image: docker.io/valkey/valkey:8@sha256:8f836008e0986c36adf50da714c7060cf689dbb335f61fe077939d90fa650809
         options: >-
           --health-cmd "valkey-cli ping"
           --health-interval 5s
diff --git a/docker-compose.yml b/docker-compose.yml
index eedd9946..457ae94c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -30,7 +30,7 @@ services:
     restart: unless-stopped
 
   valkey:
-    image: valkey/valkey:8@sha256:640c5e62cea04b6d6f2084232651d0cc70362d31f4f805e7be94dbed6855e8f2
+    image: valkey/valkey:8@sha256:8f836008e0986c36adf50da714c7060cf689dbb335f61fe077939d90fa650809
     command: ["valkey-server", "--requirepass", "${KEEN_REDIS_PASSWORD:-ChangeMe123!}"]
     environment:
       - KEEN_REDIS_PASSWORD=${KEEN_REDIS_PASSWORD:-ChangeMe123!}
diff --git a/services/api/Dockerfile b/services/api/Dockerfile
index 301ce04e..b8e40a1d 100644
--- a/services/api/Dockerfile
+++ b/services/api/Dockerfile
@@ -1,5 +1,5 @@
 # Pinned by digest; tools/docker_image_pins.py keeps the digest current.
-FROM python:3.12-slim@sha256:a0f57064cbdcd6285fa45f51237ab0b35ea8ebaed06a1f5973e89e19dfb86704
+FROM python:3.12-slim@sha256:12316debbfb86890f6b2d825820612741ba527ad5a44e3902759141d572bfe8f
 
 WORKDIR /app