diff --git a/Dockerfile b/Dockerfile
index a8c40b0..d2d4c5f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -21,7 +21,7 @@
 # workflow already sets up buildx.
 
 # --- stamp CAP_NET_RAW onto the binary (runs natively on the build host) ---
-FROM --platform=$BUILDPLATFORM debian:13-slim@sha256:3a39a0592364683e6bab97937b72cad5a8fa6dcbbee90edb3bb48c7f8e94f258 AS setcap
+FROM --platform=$BUILDPLATFORM debian:13-slim@sha256:d7e12182ce18b85b93007c1dedf31f2d29e01ccf3182cc4017c709b6259bc132 AS setcap
 RUN apt-get update \
     && apt-get install -y --no-install-recommends libcap2-bin \
     && rm -rf /var/lib/apt/lists/*
@@ -45,7 +45,7 @@ RUN setcap cap_net_raw+ep /pingularity \
     && chmod 0700 /seed/pingularity
 
 # --- final image: distroless nonroot, carrying the capped binary ---
-FROM gcr.io/distroless/static-debian13:nonroot@sha256:1c2c046bc09ed40fad370b599a0b1ae7987f55b01e247cf27a7c27cd97e5bbc7
+FROM gcr.io/distroless/static-debian13:nonroot@sha256:e2e927ec666bae08560abb3c55d0659eceabb657f56b6782ab500a9fc7f555e3
 # Static attribution; version/revision are stamped per build by goreleaser
 # (dockers_v2 labels/annotations in .goreleaser.yaml), not hardcoded here.
 LABEL org.opencontainers.image.title="pingularity" \
diff --git a/Dockerfile.iperf b/Dockerfile.iperf
index e8f69a2..4a8146c 100644
--- a/Dockerfile.iperf
+++ b/Dockerfile.iperf
@@ -22,7 +22,7 @@
 # in the default Dockerfile so the two bases stay in lock-step.
 
 # --- stamp CAP_NET_RAW onto the binary (runs natively on the build host) ---
-FROM --platform=$BUILDPLATFORM debian:13-slim@sha256:3a39a0592364683e6bab97937b72cad5a8fa6dcbbee90edb3bb48c7f8e94f258 AS setcap
+FROM --platform=$BUILDPLATFORM debian:13-slim@sha256:d7e12182ce18b85b93007c1dedf31f2d29e01ccf3182cc4017c709b6259bc132 AS setcap
 RUN apt-get update \
     && apt-get install -y --no-install-recommends libcap2-bin \
     && rm -rf /var/lib/apt/lists/*
@@ -45,7 +45,7 @@ COPY $TARGETPLATFORM/pingularity /pingularity
 RUN setcap cap_net_raw+ep /pingularity && mkdir -p /data && touch /data/.pingularity-image-dir
 
 # --- final image: debian-slim carrying iperf3 + the capped binary ---
-FROM debian:13-slim@sha256:3a39a0592364683e6bab97937b72cad5a8fa6dcbbee90edb3bb48c7f8e94f258
+FROM debian:13-slim@sha256:d7e12182ce18b85b93007c1dedf31f2d29e01ccf3182cc4017c709b6259bc132
 # Static attribution; version/revision are stamped per build by goreleaser
 # (dockers_v2 labels/annotations in .goreleaser.yaml), not hardcoded here.
 LABEL org.opencontainers.image.title="pingularity" \