diff --git a/Dockerfile b/Dockerfile
index ce62bd9..fdac488 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.25
 
-ARG DEBIAN_TRIXIE_SLIM=docker.io/library/debian:trixie-slim@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2
+ARG DEBIAN_TRIXIE_SLIM=docker.io/library/debian:trixie-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd
 
 # build-env runs on the BUILD host (so the arm/v7 and arm/v5 images cross-compile on an amd64/arm64
 # runner rather than under slow QEMU). For a native target (amd64 on amd64, arm64 on arm64) the
diff --git a/e2e/valgrind/Dockerfile b/e2e/valgrind/Dockerfile
index d1eeeb1..acccf73 100644
--- a/e2e/valgrind/Dockerfile
+++ b/e2e/valgrind/Dockerfile
@@ -1,7 +1,7 @@
 # Builds the reflector with debug symbols and NO sanitizers (ASan and valgrind are mutually
 # exclusive), then packages it under valgrind. Used by soak.py to leak-check the daemon under a
 # sustained mDNS/SSDP flood. Build from the repo root: docker build -f e2e/valgrind/Dockerfile .
-ARG DEBIAN=docker.io/library/debian:trixie-slim@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2
+ARG DEBIAN=docker.io/library/debian:trixie-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd
 
 FROM ${DEBIAN} AS build
 RUN apt-get update \