diff --git a/v24.04/11.0.1/.trivyignore b/v24.04/11.0.1/.trivyignore
index 5375004..669cba6 100644
--- a/v24.04/11.0.1/.trivyignore
+++ b/v24.04/11.0.1/.trivyignore
@@ -39,3 +39,15 @@ CVE-2026-84445
 CVE-2026-78667
 CVE-2026-78669
 CVE-2026-97031
+
+# not fixed in this bundle: Go standard library go1.26.8, reported from the same
+# apps/migrate_to_ocis/bin/rclone_linux_amd64 (rclone v1.75.1). Fixed in
+# go1.26.10, which no rclone release is built with yet (v1.75.2 uses go1.26.9).
+# GO-2026-6809 adds a crypto/x509 denylist of compromised intermediate CAs. rclone
+# is only a client here, so the exposure is a man-in-the-middle presenting a chain
+# through such an intermediate while an admin runs the files migration
+# (`occ migrate:to-ocis:migrate:files`, the only step where rclone connects). With
+# --insecure (-k) certificates are not verified at all, so the denylist would not
+# help there either. Do not carry this into the next 11.0.x file once its bundle
+# ships a migrate_to_ocis whose rclone is built with go >= 1.26.10.
+CVE-2026-111943
diff --git a/v24.04/Dockerfile.multiarch b/v24.04/Dockerfile.multiarch
index 19321b1..0644369 100644
--- a/v24.04/Dockerfile.multiarch
+++ b/v24.04/Dockerfile.multiarch
@@ -1,4 +1,4 @@
-FROM owncloud/base:24.04@sha256:02b669b388adaef2aa599a81557bb1d4412ee5861a3dc723890735c299969024
+FROM owncloud/base:24.04@sha256:925f1156dd972e3b98e392e4fbd2b841f337cd8536fbad467bf360ee6670bff9
 
 ARG TARBALL_URL