diff --git a/Dockerfile b/Dockerfile
index 0e810f0..bc029a0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,7 +14,7 @@
 # The builder runs on the machine that does the build and emits a binary for
 # the target platform. An arm64 image needs no emulation, and a clean checkout
 # rebuilds the image without CI copying a binary in.
-FROM --platform=$BUILDPLATFORM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS builder
+FROM --platform=$BUILDPLATFORM golang:1.27-alpine@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125 AS builder
 
 # CGO off makes the binary static. A static binary is the only thing the final
 # stage needs beside git.