diff --git a/release/docker/Dockerfile.breg b/release/docker/Dockerfile.breg
index ab34e553b..6870b3376 100644
--- a/release/docker/Dockerfile.breg
+++ b/release/docker/Dockerfile.breg
@@ -28,7 +28,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
     && install -m 0644 /workspace/THIRD_PARTY_NOTICES /workspace/runtime-root/licenses/breg/THIRD_PARTY_NOTICES \
     && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +
 
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c AS runtime
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime
 
 LABEL org.registrystack.runtime.uid="65532" \
       org.registrystack.runtime.gid="65532"
diff --git a/release/docker/Dockerfile.builder b/release/docker/Dockerfile.builder
index 2207fcfa8..161e8520b 100644
--- a/release/docker/Dockerfile.builder
+++ b/release/docker/Dockerfile.builder
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
 
-FROM rust:1.95-trixie@sha256:f49565f188ee00bc2a18dd418183f2c5f23ef7d6e691890517ed341a598f67c3 AS builder
+FROM rust:1.97-trixie@sha256:b1b3c9c0d921d7fa0a6d1f9ec7e4eab87f8c8ec97644c3d791450f131dec813f AS builder
 
 # pg_query 6.1.1 always invokes bindgen and regenerates its Rust protobuf types
 # when Cargo exposes a protoc command. Freeze the archive and build packages so
diff --git a/release/docker/Dockerfile.casework b/release/docker/Dockerfile.casework
index 7d6ffbfb6..1f8f28335 100644
--- a/release/docker/Dockerfile.casework
+++ b/release/docker/Dockerfile.casework
@@ -29,7 +29,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
     && chmod 0700 /workspace/runtime-root/var/lib/registry-casework/audit \
     && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +
 
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c AS runtime
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime
 
 LABEL org.registrystack.runtime.uid="65532" \
       org.registrystack.runtime.gid="65532"
diff --git a/release/docker/Dockerfile.discovery b/release/docker/Dockerfile.discovery
index 94f98b61e..645d04dbd 100644
--- a/release/docker/Dockerfile.discovery
+++ b/release/docker/Dockerfile.discovery
@@ -25,7 +25,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
     && install -m 0644 /workspace/LICENSE /workspace/runtime-root/licenses/discovery/LICENSE \
     && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +
 
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c AS runtime
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime
 
 LABEL org.registrystack.runtime.uid="65532" \
       org.registrystack.runtime.gid="65532"
diff --git a/release/docker/Dockerfile.evidence b/release/docker/Dockerfile.evidence
index 52229c6e9..5e5087318 100644
--- a/release/docker/Dockerfile.evidence
+++ b/release/docker/Dockerfile.evidence
@@ -25,7 +25,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
     && chmod 0700 /workspace/runtime-root/var/lib/registry-evidence/audit \
     && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +
 
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c AS runtime
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime
 
 LABEL org.registrystack.runtime.uid="65532" \
       org.registrystack.runtime.gid="65532"
diff --git a/release/docker/Dockerfile.relay b/release/docker/Dockerfile.relay
index e03a93d8d..af0ef5812 100644
--- a/release/docker/Dockerfile.relay
+++ b/release/docker/Dockerfile.relay
@@ -30,7 +30,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
     && chmod 0700 /workspace/runtime-root/var/lib/relay/audit \
     && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +
 
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c AS runtime
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime
 
 LABEL org.registrystack.runtime.uid="65532" \
       org.registrystack.runtime.gid="65532"