diff --git a/.github/workflows/compose-ci.yml b/.github/workflows/compose-ci.yml
index a446d3c2..b3592259 100644
--- a/.github/workflows/compose-ci.yml
+++ b/.github/workflows/compose-ci.yml
@@ -285,7 +285,7 @@ jobs:
       FLOWTEST_FEATURE_EVENT_PROTOCOLS_ENABLED: "true"
       FLOWTEST_FEATURE_PERFORMANCE_LAB_ENABLED: "true"
       FLOWTEST_FEATURE_ENVIRONMENT_LAB_ENABLED: "true"
-      FLOWTEST_ENVIRONMENT_IMAGE_ALLOWLIST: '["docker.io/nginxinc/nginx-unprivileged@sha256:442753882674b49ae2c1de83ed67896131c0777f56df5005e356e62bc3f7e7ce"]'
+      FLOWTEST_ENVIRONMENT_IMAGE_ALLOWLIST: '["docker.io/nginxinc/nginx-unprivileged@sha256:123fb7283ffb4788e260d4e980005a978995fefedcdbb04d268077a19b84576d"]'
       FLOWTEST_AI_BASE_URL: http://mock-target:8080/v1
       FLOWTEST_AI_MODEL: flowtest-compose-model
       FLOWTEST_AI_API_KEY: flowtest-mock-ai-key
diff --git a/.github/workflows/security-ci.yml b/.github/workflows/security-ci.yml
index 01891e5e..b5619e05 100644
--- a/.github/workflows/security-ci.yml
+++ b/.github/workflows/security-ci.yml
@@ -67,8 +67,8 @@ jobs:
           docker build --target runner-runtime -t flowtest-runner:ci backend
           docker build -t flowtest-frontend:ci frontend
           docker build -t flowtest-mock-target:ci mock-target
-          docker pull docker.io/nginxinc/nginx-unprivileged@sha256:442753882674b49ae2c1de83ed67896131c0777f56df5005e356e62bc3f7e7ce
-          docker tag docker.io/nginxinc/nginx-unprivileged@sha256:442753882674b49ae2c1de83ed67896131c0777f56df5005e356e62bc3f7e7ce flowtest-environment-fixture:ci
+          docker pull docker.io/nginxinc/nginx-unprivileged@sha256:123fb7283ffb4788e260d4e980005a978995fefedcdbb04d268077a19b84576d
+          docker tag docker.io/nginxinc/nginx-unprivileged@sha256:123fb7283ffb4788e260d4e980005a978995fefedcdbb04d268077a19b84576d flowtest-environment-fixture:ci
       - name: Scan backend image
         uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
         with:
diff --git a/backend/tests/test_environment_lab.py b/backend/tests/test_environment_lab.py
index bc1d0d79..95106fa3 100644
--- a/backend/tests/test_environment_lab.py
+++ b/backend/tests/test_environment_lab.py
@@ -43,7 +43,7 @@
 USER_PASSWORD = "environment-user-password-123!"
 FIXTURE_IMAGE = (
     "docker.io/nginxinc/nginx-unprivileged@sha256:"
-    "442753882674b49ae2c1de83ed67896131c0777f56df5005e356e62bc3f7e7ce"
+    "123fb7283ffb4788e260d4e980005a978995fefedcdbb04d268077a19b84576d"
 )
 
 
diff --git a/frontend/src/pages/EnvironmentLabPage.test.tsx b/frontend/src/pages/EnvironmentLabPage.test.tsx
index 3813224c..c61fa93c 100644
--- a/frontend/src/pages/EnvironmentLabPage.test.tsx
+++ b/frontend/src/pages/EnvironmentLabPage.test.tsx
@@ -16,7 +16,7 @@ import { server } from '../test/server'
 import EnvironmentLabPage from './EnvironmentLabPage'
 
 const fixtureImage =
-  'docker.io/nginxinc/nginx-unprivileged@sha256:442753882674b49ae2c1de83ed67896131c0777f56df5005e356e62bc3f7e7ce'
+  'docker.io/nginxinc/nginx-unprivileged@sha256:123fb7283ffb4788e260d4e980005a978995fefedcdbb04d268077a19b84576d'
 
 const template: EnvironmentTemplateVersion = {
   id: '00000000-0000-4000-8000-000000001001',
diff --git a/frontend/src/pages/EnvironmentLabPage.tsx b/frontend/src/pages/EnvironmentLabPage.tsx
index b4666c04..b42f30cf 100644
--- a/frontend/src/pages/EnvironmentLabPage.tsx
+++ b/frontend/src/pages/EnvironmentLabPage.tsx
@@ -549,7 +549,7 @@ function TemplateDialog({
 }
 
 const fixtureImage =
-  'docker.io/nginxinc/nginx-unprivileged@sha256:442753882674b49ae2c1de83ed67896131c0777f56df5005e356e62bc3f7e7ce'
+  'docker.io/nginxinc/nginx-unprivileged@sha256:123fb7283ffb4788e260d4e980005a978995fefedcdbb04d268077a19b84576d'
 
 function templateFormValues(base?: EnvironmentTemplateVersion): TemplateForm {
   return base ? versionFormValues(base) : defaultTemplateFormValues
diff --git a/scripts/smoke_s26.py b/scripts/smoke_s26.py
index 772d4636..d60e0b52 100755
--- a/scripts/smoke_s26.py
+++ b/scripts/smoke_s26.py
@@ -15,7 +15,7 @@
 
 FIXTURE_IMAGE = (
     "docker.io/nginxinc/nginx-unprivileged@sha256:"
-    "442753882674b49ae2c1de83ed67896131c0777f56df5005e356e62bc3f7e7ce"
+    "123fb7283ffb4788e260d4e980005a978995fefedcdbb04d268077a19b84576d"
 )