diff --git a/Cargo.lock b/Cargo.lock
index 03b1bf8..749d9c6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -387,9 +387,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chacha20"
-version = "0.10.0"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures",
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 06b489a..261676a 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -11,7 +11,7 @@
 # (oci.stackable.tech/sdp/ubi9-rust-builder); the COPY+cargo step below
 # is a no-op when the binary is already present at /app.
 
-ARG BUILDER_IMAGE=docker.io/library/rust:1.93-slim-bookworm
+ARG BUILDER_IMAGE=docker.io/library/rust:1.97.1-slim-bookworm
 
 # hadolint ignore=DL3006
 FROM ${BUILDER_IMAGE} AS builder