diff --git a/Dockerfile b/Dockerfile
index a8c40b0..81f003a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -45,7 +45,7 @@ RUN setcap cap_net_raw+ep /pingularity \
     && chmod 0700 /seed/pingularity
 
 # --- final image: distroless nonroot, carrying the capped binary ---
-FROM gcr.io/distroless/static-debian13:nonroot@sha256:1c2c046bc09ed40fad370b599a0b1ae7987f55b01e247cf27a7c27cd97e5bbc7
+FROM gcr.io/distroless/static-debian13:nonroot@sha256:516757106de35205efb70b91ba03f6f1298424a0678c603255cf2852a7000087
 # Static attribution; version/revision are stamped per build by goreleaser
 # (dockers_v2 labels/annotations in .goreleaser.yaml), not hardcoded here.
 LABEL org.opencontainers.image.title="pingularity" \