diff --git a/Dockerfile b/Dockerfile
index 734a0dd..ff77765 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,7 +23,7 @@
 #  - HP_SHARED_KEY or HP_SHARED_KEY_FILE must be provided at runtime.
 # -------------------------------------------------------------------------
 
-FROM docker.io/library/haproxy:3.1.2-alpine3.21
+FROM docker.io/library/haproxy:3.2.22-alpine3.24
 
 USER root
 
@@ -65,10 +65,13 @@ RUN set -ex; \
         netcat-openbsd; \
     chmod -R 777 /tmp;
 
-# Install the Python SPOA library
+# Install the Python SPOA library.
+# Pinned to a commit: the single-write frame emission it contains is required for
+# HAProxy 3.2+, whose SPOP mux resets connections when a frame arrives split
+# across TCP segments. Bump this deliberately together with the library.
 RUN pip install --break-system-packages \
-        pydantic==2.10.6 \
-        git+https://github.com/cloud-py-api/haproxy-python-spoa.git
+        pydantic==2.13.4 \
+        git+https://github.com/cloud-py-api/haproxy-python-spoa.git@f00f3f7b1b0f56e10052af6c0d07e81c5195d84d
 
 # Copy our scripts and templates
 COPY --chmod=755 healthcheck.sh /healthcheck.sh
diff --git a/development/debugging/Dockerfile b/development/debugging/Dockerfile
index e255263..e6651df 100644
--- a/development/debugging/Dockerfile
+++ b/development/debugging/Dockerfile
@@ -1,7 +1,7 @@
 # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
-FROM haproxy:3.1.2-alpine3.21
+FROM haproxy:3.2.22-alpine3.24
 
 USER root