diff --git a/Dockerfile.dockerfile b/Dockerfile.dockerfile
index 2099743..e6c21ee 100644
--- a/Dockerfile.dockerfile
+++ b/Dockerfile.dockerfile
@@ -29,7 +29,7 @@ COPY vendor/tmux-resurrect /opt/agent-code-server/managed-tools/vendor/tmux-resu
 COPY vendor/tmux-continuum /opt/agent-code-server/managed-tools/vendor/tmux-continuum
 
 # ── Stage: code-server build ────────────────────────────────────────
-FROM debian:13-slim@sha256:d7e12182ce18b85b93007c1dedf31f2d29e01ccf3182cc4017c709b6259bc132 AS code-server-builder
+FROM debian:13-slim@sha256:a99cfc517144bc59b1978475ec53b46ecabec7e43635402ee5b77cc54cd1b20a AS code-server-builder
 
 # We copy code-server from the official release .deb rather than building
 # from source. This stage pins the exact version and architecture.
@@ -58,7 +58,7 @@ RUN mkdir /relay \
      | tar xzf - -C /relay
 
 # ── Stage: runtime ──────────────────────────────────────────────────
-FROM debian:13-slim@sha256:d7e12182ce18b85b93007c1dedf31f2d29e01ccf3182cc4017c709b6259bc132 AS runtime
+FROM debian:13-slim@sha256:a99cfc517144bc59b1978475ec53b46ecabec7e43635402ee5b77cc54cd1b20a AS runtime
 
 ENV DEBIAN_FRONTEND=noninteractive