diff --git a/devpi/Dockerfile b/devpi/Dockerfile
index e283182..44c1988 100644
--- a/devpi/Dockerfile
+++ b/devpi/Dockerfile
@@ -1,7 +1,7 @@
 # Artea devpi image: PyPI pull-through cache + Artea policy filtering.
 # Internal-only service; the gateway enforces auth (see docs/ARCHITECTURE.md).
 # Base = python:3.14-slim, digest-pinned (ADR-0004; bump procedure in policy-sync/Dockerfile).
-FROM python:3.14-slim@sha256:b877e50bd90de10af8d82c57a022fc2e0dc731c5320d762a27986facfc3355c1
+FROM python:3.14-slim@sha256:d3400aa122fa42cf0af0dbe8ec3091b047eac5c8f7e3539f7135e86d855dc015
 
 # Exact pins; the single source of truth for the devpi-server version.
 ARG DEVPI_SERVER_VERSION=6.20.2
diff --git a/policy-sync/Dockerfile b/policy-sync/Dockerfile
index c5ad3f2..2182e3c 100644
--- a/policy-sync/Dockerfile
+++ b/policy-sync/Dockerfile
@@ -3,7 +3,7 @@
 # devpi/README.md), so no pip dependencies at all.
 # Base = python:3.14-slim, digest-pinned (ADR-0004); bump procedure in
 # docs/guides/operations.md ("Base-image digest pins").
-FROM python:3.14-slim@sha256:b877e50bd90de10af8d82c57a022fc2e0dc731c5320d762a27986facfc3355c1
+FROM python:3.14-slim@sha256:d3400aa122fa42cf0af0dbe8ec3091b047eac5c8f7e3539f7135e86d855dc015
 
 WORKDIR /app
 COPY policy_sync ./policy_sync
diff --git a/scripts/Dockerfile.bootstrap b/scripts/Dockerfile.bootstrap
index 931b47c..8fcb411 100644
--- a/scripts/Dockerfile.bootstrap
+++ b/scripts/Dockerfile.bootstrap
@@ -10,7 +10,7 @@
 # No jq (the script parses JSON with python3) and no docker.
 #
 # Base = python:3.14-slim, digest-pinned (ADR-0004; bump procedure in policy-sync/Dockerfile).
-FROM python:3.14-slim@sha256:b877e50bd90de10af8d82c57a022fc2e0dc731c5320d762a27986facfc3355c1
+FROM python:3.14-slim@sha256:d3400aa122fa42cf0af0dbe8ec3091b047eac5c8f7e3539f7135e86d855dc015
 
 RUN apt-get update \
  && apt-get install -y --no-install-recommends curl ca-certificates \