diff --git a/Dockerfile.api b/Dockerfile.api
index 5a954a9..ddf7750 100644
--- a/Dockerfile.api
+++ b/Dockerfile.api
@@ -6,7 +6,7 @@
 # Dockerfile can produce a different image tomorrow, so a reproducible build and an audited
 # base are impossible with tags alone. Refresh with:
 #   docker buildx imagetools inspect mcr.microsoft.com/dotnet/sdk:10.0 --format '{{.Manifest.Digest}}'
-FROM mcr.microsoft.com/dotnet/sdk:10.0@sha256:e1fc6e423f543119c406d24e2e687d67c569f18f04a37a8b0005d80ad0dcee80 AS build
+FROM mcr.microsoft.com/dotnet/sdk:10.0@sha256:e1ffd2a92ae84c1291bc1b6887501f8af98e6331e7af6d4c8d37168c5e87a64c AS build
 WORKDIR /src
 
 # Restore first (leverages layer caching) by copying only the project files and lock files.
@@ -28,7 +28,7 @@ COPY src/ src/
 RUN dotnet publish src/TodoApp.WebApi/TodoApp.WebApi.csproj \
     -c Release -o /app/publish --no-restore /p:UseAppHost=false
 
-FROM mcr.microsoft.com/dotnet/aspnet:10.0@sha256:207cc51496778557731c81ff670333d8ade4a4fec22768fd1be8e78474a84ecf AS final
+FROM mcr.microsoft.com/dotnet/aspnet:10.0@sha256:a4556ed033fa96f984bb7a8d348851cb2d36b1281dd2420070045f664fbb5f94 AS final
 WORKDIR /app
 COPY --from=build /app/publish .