diff --git a/app/api/Dockerfile b/app/api/Dockerfile
index 3e026ec..7956b72 100644
--- a/app/api/Dockerfile
+++ b/app/api/Dockerfile
@@ -1,6 +1,6 @@
 # Build from the repo root so the shared cedar/ policies are in context:
 #   docker build -t cloudsec-api:local -f app/api/Dockerfile .
-FROM python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9 AS base
+FROM python:3.14-slim@sha256:44dd04494ee8f3b538294360e7c4b3acb87c8268e4d0a4828a6500b1eff50061 AS base
 
 # Non-root, high UID (passes the namespace's restricted Pod Security).
 RUN useradd --uid 10001 --create-home --shell /usr/sbin/nologin appuser