diff --git a/docker/Dockerfile b/docker/Dockerfile
index b3d5c49..99b874b 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -18,7 +18,7 @@
 # Base image pinned by digest for reproducible, supply-chain-safe builds;
 # Dependabot (docker ecosystem) keeps the digest current. Tag is retained for
 # human readability — the digest is what actually resolves.
-FROM python:3.14-slim@sha256:cea0e6040540fb2b965b6e7fb5ffa00871e632eef63719f0ea54bca189ce14a6 AS builder
+FROM python:3.14-slim@sha256:a7fb1e634c4a578f9e0bd6327f11a3cde11b7a9395f48e24360c0988bcc5c2bc AS builder
 
 # uv from PyPI; pin the project's tooling requirements via pyproject if
 # stricter reproducibility is wanted at CI time.
@@ -38,7 +38,7 @@ RUN uv sync --frozen --no-dev --no-install-project
 # =============================================================
 # Stage 2 — runtime: minimal image with only venv + source
 # =============================================================
-FROM python:3.14-slim@sha256:cea0e6040540fb2b965b6e7fb5ffa00871e632eef63719f0ea54bca189ce14a6 AS runtime
+FROM python:3.14-slim@sha256:a7fb1e634c4a578f9e0bd6327f11a3cde11b7a9395f48e24360c0988bcc5c2bc AS runtime
 
 # OCI metadata — picked up by GHCR, Trivy, Renovate, and similar tooling.
 # CI can override ``revision``/``version`` at build time via ``--label``.