diff --git a/Dockerfile b/Dockerfile
index 17f2ca4..1e383c0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -45,7 +45,7 @@ RUN cargo auditable build --release --locked \
 # dynamically-linked Rust binary (rustls' ring backend links to libc).
 # OCI image-index digest (2026-05); Dependabot tracks updates per the
 # docker ecosystem entry in `.github/dependabot.yml`.
-FROM gcr.io/distroless/cc-debian12:nonroot@sha256:bd2899c12b335c827750ccf2359879eab09c09b206023dcebea408947d54127c AS runtime
+FROM gcr.io/distroless/cc-debian12:nonroot@sha256:b0ae8e989418b458e0f25489bc3be523718938a2b70864cc0f6a00af1ddbd985 AS runtime
 
 # OCI image annotations improve Trivy / Grype scan output + GitHub Packages
 # display.