diff --git a/docker/Dockerfile.chainguard b/docker/Dockerfile.chainguard
index d1de39f..7bef322 100644
--- a/docker/Dockerfile.chainguard
+++ b/docker/Dockerfile.chainguard
@@ -36,7 +36,7 @@
 # symlink (COPYing a real `/lib` dir onto it fails). The digest
 # is pinned for reproducibility (A11); resolve with
 #   docker buildx imagetools inspect cgr.dev/chainguard/wolfi-base:latest --raw | sha256sum
-FROM cgr.dev/chainguard/wolfi-base:latest@sha256:2f7a5c164eafbdbe46fe1d91bd1ab4c8cb5c2bdbd10641c3d61bd39962384cdb AS nsupdate
+FROM cgr.dev/chainguard/wolfi-base:latest@sha256:42df77a9974d6ec8b17a5ee8bc23b532600a44d705acef2409e0933c1251b45f AS nsupdate
 RUN apk add --no-cache bind-tools \
  && mkdir -p /staging/usr/bin \
  && cp -L /usr/bin/nsupdate /staging/usr/bin/ \