diff --git a/release/docker/Dockerfile.discovery b/release/docker/Dockerfile.discovery
index 7e2eea48f..d320d5b90 100644
--- a/release/docker/Dockerfile.discovery
+++ b/release/docker/Dockerfile.discovery
@@ -20,7 +20,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
     && install -m 0644 /workspace/LICENSE /workspace/runtime-root/licenses/discovery/LICENSE \
     && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +
 
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:d97bc0a941b8d4be647dc0ee75b264ddbb772f1ac5ba690a4309c00723b23775 AS runtime
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:a77defd6fedbb3392b175ba8ea3d1c22be963c1597c248c3ba987ddd80bfb512 AS runtime
 
 LABEL org.registrystack.runtime.uid="65532" \
       org.registrystack.runtime.gid="65532"
diff --git a/release/docker/Dockerfile.evidence b/release/docker/Dockerfile.evidence
index 948b8b152..abaf75169 100644
--- a/release/docker/Dockerfile.evidence
+++ b/release/docker/Dockerfile.evidence
@@ -18,7 +18,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
     && chmod 0700 /workspace/runtime-root/var/lib/registry-evidence/audit \
     && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +
 
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:d97bc0a941b8d4be647dc0ee75b264ddbb772f1ac5ba690a4309c00723b23775 AS runtime
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:a77defd6fedbb3392b175ba8ea3d1c22be963c1597c248c3ba987ddd80bfb512 AS runtime
 
 LABEL org.registrystack.runtime.uid="65532" \
       org.registrystack.runtime.gid="65532"
diff --git a/release/docker/Dockerfile.mint b/release/docker/Dockerfile.mint
index 55adca7b0..7527326c0 100644
--- a/release/docker/Dockerfile.mint
+++ b/release/docker/Dockerfile.mint
@@ -18,7 +18,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
     && chmod 0700 /workspace/runtime-root/var/lib/registry-mint/audit \
     && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +
 
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:d97bc0a941b8d4be647dc0ee75b264ddbb772f1ac5ba690a4309c00723b23775 AS runtime
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:a77defd6fedbb3392b175ba8ea3d1c22be963c1597c248c3ba987ddd80bfb512 AS runtime
 
 LABEL org.registrystack.runtime.uid="65532" \
       org.registrystack.runtime.gid="65532"
diff --git a/release/docker/Dockerfile.relay b/release/docker/Dockerfile.relay
index 525022486..04167d9cf 100644
--- a/release/docker/Dockerfile.relay
+++ b/release/docker/Dockerfile.relay
@@ -23,7 +23,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
     && chmod 0700 /workspace/runtime-root/var/lib/relay/audit \
     && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +
 
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:d97bc0a941b8d4be647dc0ee75b264ddbb772f1ac5ba690a4309c00723b23775 AS runtime
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:a77defd6fedbb3392b175ba8ea3d1c22be963c1597c248c3ba987ddd80bfb512 AS runtime
 
 LABEL org.registrystack.runtime.uid="65532" \
       org.registrystack.runtime.gid="65532"