diff --git a/src/codeprobe/sandbox/Dockerfile.scoring b/src/codeprobe/sandbox/Dockerfile.scoring
index 7c77d31..250ae4c 100644
--- a/src/codeprobe/sandbox/Dockerfile.scoring
+++ b/src/codeprobe/sandbox/Dockerfile.scoring
@@ -6,7 +6,7 @@
 # bash, git, and coreutils for the scripts themselves. Scoring containers
 # run with --network=none: nothing in this image may assume network egress
 # at runtime, and mined tests that need it fail closed by design.
-FROM debian:bookworm-slim@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818
+FROM debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171
 
 ARG DEBIAN_SNAPSHOT=20260728T000000Z