diff --git a/Containerfile b/Containerfile
index 389f128..137e3ba 100644
--- a/Containerfile
+++ b/Containerfile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.26.5@sha256:ae5a2316d12f3e78fd99177dad452e6ad4f240af2d71d57b480c3477f250fec6 AS builder
+FROM golang:1.26.5@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647 AS builder
 
 # Optional Go build tags (e.g. "otel" for OpenTelemetry support).
 # Default (empty) produces a standard build without optional features.
diff --git a/Containerfile.cli-stack.rh b/Containerfile.cli-stack.rh
index 93baa40..614d88d 100644
--- a/Containerfile.cli-stack.rh
+++ b/Containerfile.cli-stack.rh
@@ -1,4 +1,4 @@
-FROM registry.redhat.io/ubi9/go-toolset:9.8-1784190466@sha256:f99dd81b20e5971ef9f63a51ac27cf0aa591ff9921d021490548b67fd9b17144 AS build-cross-platform
+FROM registry.redhat.io/ubi9/go-toolset:9.8-1785360201@sha256:272a3dd990bba320c2e246119a0019d10d627d0104938d5db77ba5ab3ae3a51d AS build-cross-platform
 ENV APP_ROOT=/opt/app-root \
     GOPATH=/opt/app-root
 
@@ -18,7 +18,7 @@ FROM --platform=linux/arm64   quay.io/securesign/model-transparency-go@sha256:9c
 FROM --platform=linux/ppc64le quay.io/securesign/model-transparency-go@sha256:b2f4d793fb7ea549ec05afd97cf3bdea964ebd33a08a862486392953cfe64f8f AS build-ppc64le
 FROM --platform=linux/s390x   quay.io/securesign/model-transparency-go@sha256:a36ec195ebd459a5874dadf181342908c0fbd2b3fadc05622125744e686c88b4 AS build-s390x
 
-FROM registry.redhat.io/ubi9/go-toolset:9.8-1784190466@sha256:f99dd81b20e5971ef9f63a51ac27cf0aa591ff9921d021490548b67fd9b17144 AS packager
+FROM registry.redhat.io/ubi9/go-toolset:9.8-1785360201@sha256:272a3dd990bba320c2e246119a0019d10d627d0104938d5db77ba5ab3ae3a51d AS packager
 USER root
 RUN mkdir -p /binaries
 
@@ -89,7 +89,7 @@ RUN tar -czf /binaries/model_transparency_cli_windows_amd64.exe.gz -C /tmp model
 RUN chmod -R a+rX /binaries
 
 # Final minimal image with all binaries
-FROM registry.redhat.io/ubi9/ubi-micro:9.8-1782840931@sha256:35de56a9413112f1474e392ebc35e0cf6f0fb484c8e8877bbae59b513694b41f
+FROM registry.redhat.io/ubi9/ubi-micro:9.8-1784702951@sha256:b1e86b97028b8fcfb6d85f997c39e6b6b67496163ef8d80d243220a4918e8bef
 
 LABEL description="Flat image containing model-transparency CLI binaries for all platforms and architectures"
 LABEL io.k8s.description="Flat image containing model-transparency CLI binaries for all platforms and architectures"
diff --git a/Containerfile.model-transparency-go.rh b/Containerfile.model-transparency-go.rh
index ad59568..dd81a8c 100644
--- a/Containerfile.model-transparency-go.rh
+++ b/Containerfile.model-transparency-go.rh
@@ -1,4 +1,4 @@
-FROM registry.redhat.io/ubi9/go-toolset:9.8-1784190466@sha256:f99dd81b20e5971ef9f63a51ac27cf0aa591ff9921d021490548b67fd9b17144 AS build-env
+FROM registry.redhat.io/ubi9/go-toolset:9.8-1785360201@sha256:272a3dd990bba320c2e246119a0019d10d627d0104938d5db77ba5ab3ae3a51d AS build-env
 
 ARG BUILD_TAGS=""
 
@@ -38,7 +38,7 @@ RUN set -euo pipefail; \
     git update-index --no-assume-unchanged Containerfile.model-transparency-go.rh; \
     git update-index --no-assume-unchanged Containerfile.cli-stack.rh
 
-FROM registry.redhat.io/ubi9/ubi-minimal@sha256:062c52ff973065752b0965787649db2bcf551a6c727a00e95a3eb42cebadbdab
+FROM registry.redhat.io/ubi9/ubi-minimal@sha256:17fd831ced9434de0a984d60b3fbe61008308261ba98bbc348d6fbdef05fa7c0
 
 COPY --from=build-env /opt/app-root/src/model_transparency_cli /usr/local/bin/model_transparency_cli
 COPY --from=build-env /opt/app-root/src/model_transparency_cli_linux /usr/local/bin/model_transparency_cli_linux
diff --git a/Containerfile.pkcs11 b/Containerfile.pkcs11
index 8d444d8..d705805 100644
--- a/Containerfile.pkcs11
+++ b/Containerfile.pkcs11
@@ -19,7 +19,7 @@
 # For hardware HSMs, bind-mount your vendor's PKCS#11 module at runtime
 # and pass the module path via --pkcs11-uri module-path attribute.
 
-FROM golang:1.26.5@sha256:ae5a2316d12f3e78fd99177dad452e6ad4f240af2d71d57b480c3477f250fec6 AS builder
+FROM golang:1.26.5@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647 AS builder
 
 # Optional Go build tags (e.g. "otel" for OpenTelemetry support).
 # Default (empty) produces a standard build without optional features.