diff --git a/caddy.Dockerfile b/caddy.Dockerfile
index 0daf6870..84203c6b 100644
--- a/caddy.Dockerfile
+++ b/caddy.Dockerfile
@@ -57,7 +57,7 @@
 #       Verify the LB is `externalTrafficPolicy: Local` + the parent
 #       Caddy's `trustedProxies` covers the LB CIDR range.
 
-FROM caddy:2.11.4-builder@sha256:f2b98918658f949a3c533f2c73bd0806e3f2576ccf8eb182c8b1690c977007ea AS builder
+FROM caddy:2.11.4-builder@sha256:ea6e54f62d2033b80747b022923ae0dd4f817ec4eefa2ca3a34cbebf16b6468c AS builder
 
 RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
     --mount=type=cache,target=/root/.cache,sharing=locked \
@@ -71,7 +71,7 @@ RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
 # when versions disagree). If this fails the RUN exits non-zero with the
 # failing command visible — no misleading prefixed echo.
 
-FROM caddy:2.11.4@sha256:cb9d71ad83182011b79355cd57692686374bd78d6fe327efe0ff8507da03ab13
+FROM caddy:2.11.4@sha256:cfeb0b281bc44a5a51fecde39e9e577c60d863c0b6196e6bbdf58fd00960887f
 
 RUN apk update && apk upgrade --no-cache && rm -rf /var/cache/apk/*