diff --git a/Dockerfile b/Dockerfile
index 7c95220..f5bd51d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # Builder: install dependencies from the committed lockfile (reproducible),
 # then hand only the finished virtualenv to the runtime stage.
-FROM python:3.14-slim@sha256:b877e50bd90de10af8d82c57a022fc2e0dc731c5320d762a27986facfc3355c1 AS builder
+FROM python:3.14-slim@sha256:d3400aa122fa42cf0af0dbe8ec3091b047eac5c8f7e3539f7135e86d855dc015 AS builder
 
 RUN pip install --no-cache-dir uv==0.9.18
 
@@ -12,7 +12,7 @@ COPY src ./src
 RUN uv sync --locked --no-dev --extra telemetry --no-editable
 
 # Runtime: same digest-pinned base, no build tooling, non-root.
-FROM python:3.14-slim@sha256:b877e50bd90de10af8d82c57a022fc2e0dc731c5320d762a27986facfc3355c1
+FROM python:3.14-slim@sha256:d3400aa122fa42cf0af0dbe8ec3091b047eac5c8f7e3539f7135e86d855dc015
 
 ENV PYTHONUNBUFFERED=1