diff --git a/sandbox/.devcontainer/Dockerfile b/sandbox/.devcontainer/Dockerfile
old mode 100755
new mode 100644
index 4ea4900..a8f2662
--- a/sandbox/.devcontainer/Dockerfile
+++ b/sandbox/.devcontainer/Dockerfile
@@ -17,7 +17,7 @@
 # git push token / ssh signing socket is forwarded. Commit & push via the
 # dedicated `git-agent` sandbox; this box is for editing and running code.
 
-FROM debian:bookworm-slim@sha256:0104b334637a5f19aa9c983a91b54c89887c0984081f2068983107a6f6c21eeb
+FROM debian:bookworm-slim@sha256:60eac759739651111db372c07be67863818726f754804b8707c90979bda511df
 
 ARG TZ=UTC
 ENV TZ="$TZ"