diff --git a/Dockerfile b/Dockerfile
index ea78906..c0aebc0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -29,7 +29,7 @@ RUN bun build --compile src/cli/main.ts --outfile /libredb
 # host directory are not root-owned (and a container escape holds no root).
 # Mount data writable by that uid, or pass `--user "$(id -u):$(id -g)"`. Pinned
 # by digest because the tag is rolling; refresh it periodically for base updates.
-FROM gcr.io/distroless/cc-debian12:nonroot@sha256:b0ae8e989418b458e0f25489bc3be523718938a2b70864cc0f6a00af1ddbd985
+FROM gcr.io/distroless/cc-debian12:nonroot@sha256:ce0d66bc0f64aae46e6a03add867b07f42cc7b8799c949c2e898057b7f75a151
 COPY --from=build /libredb /usr/local/bin/libredb
 WORKDIR /data
 ENTRYPOINT ["/usr/local/bin/libredb"]