diff --git a/Dockerfile b/Dockerfile
index 1c8e205..237cff0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -93,7 +93,7 @@ RUN --mount=type=cache,target=/root/.cargo/registry,id=cargo-registry-image-${TA
     cargo build --locked --release -p rite $CARGO_BUILD_ARGS && \
     install -D -m 0755 target/release/rite /out/rite
 
-FROM debian:trixie-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd AS runtime-base
+FROM debian:trixie-slim@sha256:3a39a0592364683e6bab97937b72cad5a8fa6dcbbee90edb3bb48c7f8e94f258 AS runtime-base
 
 # libssl3 and libpcsclite1 are the shared libraries the glibc image binary links
 # (system OpenSSL + PC/SC). The pcscd daemon and CCID driver are not installed: