diff --git a/Dockerfile b/Dockerfile
index 8302277..3826587 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.26
 
-ARG DEBIAN_TRIXIE_SLIM=docker.io/library/debian:trixie-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd
+ARG DEBIAN_TRIXIE_SLIM=docker.io/library/debian:trixie-slim@sha256:3a39a0592364683e6bab97937b72cad5a8fa6dcbbee90edb3bb48c7f8e94f258
 
 # build-env runs on the BUILD host (so the arm/v7 and arm/v5 images cross-compile on an amd64/arm64
 # runner rather than under slow QEMU). For a native target (amd64 on amd64, arm64 on arm64) the
diff --git a/e2e/valgrind/Dockerfile b/e2e/valgrind/Dockerfile
index acccf73..d02c9ee 100644
--- a/e2e/valgrind/Dockerfile
+++ b/e2e/valgrind/Dockerfile
@@ -1,7 +1,7 @@
 # Builds the reflector with debug symbols and NO sanitizers (ASan and valgrind are mutually
 # exclusive), then packages it under valgrind. Used by soak.py to leak-check the daemon under a
 # sustained mDNS/SSDP flood. Build from the repo root: docker build -f e2e/valgrind/Dockerfile .
-ARG DEBIAN=docker.io/library/debian:trixie-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd
+ARG DEBIAN=docker.io/library/debian:trixie-slim@sha256:3a39a0592364683e6bab97937b72cad5a8fa6dcbbee90edb3bb48c7f8e94f258
 
 FROM ${DEBIAN} AS build
 RUN apt-get update \