diff --git a/Dockerfile b/Dockerfile
index f948d7e..5b65d22 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,12 +11,12 @@
 # Build and runtime share one Java release: Gradle targets the JDK it runs on,
 # so a newer build JDK would produce classes the runtime cannot load.
 # Both base images are pinned by version and digest; Dependabot moves the pins.
-FROM eclipse-temurin:17.0.21_9-jdk-noble@sha256:1bedb04434bd275ef072355e9caec2a22be5240fbe82ad51a59323f2bbcab4a6 AS build
+FROM eclipse-temurin:24.0.2_12-jdk-noble@sha256:dacac8e9a0df0d2bd24e702b4431132875c249930b70555ebd7ca285b5bee684 AS build
 WORKDIR /src
 COPY . .
 RUN ./gradlew :cli:installDist --no-daemon --console=plain
 
-FROM eclipse-temurin:17.0.21_9-jre-noble@sha256:042c05a77eb915684fc8c92cfbbef4fd6f8c24ca7d934d1a7db3543453aaa077
+FROM eclipse-temurin:24.0.2_12-jre-noble@sha256:b416d02335e702b0403ff280de9475a3348e29382285969c9d4e17862ce632e7
 LABEL org.opencontainers.image.title="NOIR" \
       org.opencontainers.image.description="Android leak audit" \
       org.opencontainers.image.licenses="MIT"