diff --git a/Dockerfile b/Dockerfile
index 54f734cb..00c5f61f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -34,7 +34,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -ldflags
 # Runtime image: Debian slim with git + openssh-client for file:// git remotes and git ls-remote probes.
 # The only git export engine is go-git (default, ADR-0803), which does not require the git binary; the
 # file:// CLI machinery and connection probes do.
-FROM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251
+FROM debian:bookworm-slim@sha256:7c7b2c966bc9ee8cedfeef67e0e279108992c77681fa595db4a9d65c06ccc587
 
 RUN apt-get update && \
     apt-get upgrade -y && \