diff --git a/Dockerfile b/Dockerfile
index 17a95a07..01fd52bc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -52,7 +52,7 @@ RUN install -d -o 65532 -g 65532 /data
 # the boundary around those commands, and in a container it needs the seccomp profile in
 # deploy/seccomp (see deploy/README.md). For real project work, copy this binary into an
 # image that has your toolchain instead; busybox is the out-of-the-box minimum.
-FROM gcr.io/distroless/static-debian13:debug-nonroot@sha256:c7b8faacc4439b8f5c41ca7ce4a3f8ff3e8520cb0c3444fae7292f687b00d0dd
+FROM gcr.io/distroless/static-debian13:debug-nonroot@sha256:12c2026b21e05857a4c730b4dbf812becf02b396cb7916166c8305f45f140ab0
 
 # APP_USER selects the runtime user. The default `nonroot` (uid 65532) is the hardened
 # posture for shared-kernel hosts (Docker, Kubernetes): a Docker named volume inherits
diff --git a/Dockerfile.release b/Dockerfile.release
index 825b5023..458d3482 100644
--- a/Dockerfile.release
+++ b/Dockerfile.release
@@ -21,7 +21,7 @@ RUN install -d -o 65532 -g 65532 /data
 # the boundary around those commands, and in a container it needs the seccomp profile in
 # deploy/seccomp (see deploy/README.md). For real project work, copy this binary into an
 # image that has your toolchain instead; busybox is the out-of-the-box minimum.
-FROM gcr.io/distroless/static-debian13:debug-nonroot@sha256:c7b8faacc4439b8f5c41ca7ce4a3f8ff3e8520cb0c3444fae7292f687b00d0dd
+FROM gcr.io/distroless/static-debian13:debug-nonroot@sha256:12c2026b21e05857a4c730b4dbf812becf02b396cb7916166c8305f45f140ab0
 
 # APP_USER selects the runtime user. The default `nonroot` (uid 65532) is the hardened
 # posture for shared-kernel hosts (Docker, Kubernetes): a Docker named volume inherits