diff --git a/release/docker/Dockerfile.breg b/release/docker/Dockerfile.breg
index 53e343f35..5d43dad57 100644
--- a/release/docker/Dockerfile.breg
+++ b/release/docker/Dockerfile.breg
@@ -2,7 +2,7 @@
 
 ARG SOURCE_DATE_EPOCH=0
 
-FROM debian:trixie-slim@sha256:3a39a0592364683e6bab97937b72cad5a8fa6dcbbee90edb3bb48c7f8e94f258 AS runtime-root
+FROM debian:trixie-slim@sha256:d7e12182ce18b85b93007c1dedf31f2d29e01ccf3182cc4017c709b6259bc132 AS runtime-root
 ARG SOURCE_DATE_EPOCH
 
 ADD --checksum=sha256:967aa62605721081c3eb2a17650611a792aa802d76a6511d1840242623d204c9 https://snapshot.debian.org/archive/debian/20260913T000000Z/pool/main/g/glibc/libc6_2.41-12+deb13u4_amd64.deb /workspace/runtime-packages/libc6_2.41-12+deb13u4_amd64.deb
@@ -26,7 +26,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
     && install -m 0644 /workspace/LICENSE /workspace/runtime-root/licenses/breg/LICENSE \
     && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +
 
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c AS runtime
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime
 
 LABEL org.registrystack.runtime.uid="65532" \
       org.registrystack.runtime.gid="65532"
diff --git a/release/docker/Dockerfile.builder b/release/docker/Dockerfile.builder
index 53d1f8ff0..3258b8453 100644
--- a/release/docker/Dockerfile.builder
+++ b/release/docker/Dockerfile.builder
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
 
-FROM rust:1.95-trixie@sha256:f49565f188ee00bc2a18dd418183f2c5f23ef7d6e691890517ed341a598f67c3 AS builder
+FROM rust:1.98-trixie@sha256:9234385969911ca1f0fbf293f2290c03cd3827381b68681144090f1316cbb123 AS builder
 
 # pg_query 6.1.1 always invokes bindgen and regenerates its Rust protobuf types
 # when Cargo exposes a protoc command. Freeze the archive and both packages so
diff --git a/release/docker/Dockerfile.casework b/release/docker/Dockerfile.casework
index d7864294f..72a9a386b 100644
--- a/release/docker/Dockerfile.casework
+++ b/release/docker/Dockerfile.casework
@@ -2,7 +2,7 @@
 
 ARG SOURCE_DATE_EPOCH=0
 
-FROM debian:trixie-slim@sha256:3a39a0592364683e6bab97937b72cad5a8fa6dcbbee90edb3bb48c7f8e94f258 AS runtime-root
+FROM debian:trixie-slim@sha256:d7e12182ce18b85b93007c1dedf31f2d29e01ccf3182cc4017c709b6259bc132 AS runtime-root
 ARG SOURCE_DATE_EPOCH
 
 ADD --checksum=sha256:967aa62605721081c3eb2a17650611a792aa802d76a6511d1840242623d204c9 https://snapshot.debian.org/archive/debian/20260913T000000Z/pool/main/g/glibc/libc6_2.41-12+deb13u4_amd64.deb /workspace/runtime-packages/libc6_2.41-12+deb13u4_amd64.deb
@@ -27,7 +27,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
     && chmod 0700 /workspace/runtime-root/var/lib/registry-casework/audit \
     && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +
 
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c AS runtime
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime
 
 LABEL org.registrystack.runtime.uid="65532" \
       org.registrystack.runtime.gid="65532"
diff --git a/release/docker/Dockerfile.discovery b/release/docker/Dockerfile.discovery
index 94f98b61e..0389d5f53 100644
--- a/release/docker/Dockerfile.discovery
+++ b/release/docker/Dockerfile.discovery
@@ -2,7 +2,7 @@
 
 ARG SOURCE_DATE_EPOCH=0
 
-FROM debian:trixie-slim@sha256:3a39a0592364683e6bab97937b72cad5a8fa6dcbbee90edb3bb48c7f8e94f258 AS runtime-root
+FROM debian:trixie-slim@sha256:d7e12182ce18b85b93007c1dedf31f2d29e01ccf3182cc4017c709b6259bc132 AS runtime-root
 ARG SOURCE_DATE_EPOCH
 
 ADD --checksum=sha256:967aa62605721081c3eb2a17650611a792aa802d76a6511d1840242623d204c9 https://snapshot.debian.org/archive/debian/20260913T000000Z/pool/main/g/glibc/libc6_2.41-12+deb13u4_amd64.deb /workspace/runtime-packages/libc6_2.41-12+deb13u4_amd64.deb
@@ -25,7 +25,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
     && install -m 0644 /workspace/LICENSE /workspace/runtime-root/licenses/discovery/LICENSE \
     && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +
 
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c AS runtime
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime
 
 LABEL org.registrystack.runtime.uid="65532" \
       org.registrystack.runtime.gid="65532"
diff --git a/release/docker/Dockerfile.evidence b/release/docker/Dockerfile.evidence
index 570c2d36d..acd7cd9f0 100644
--- a/release/docker/Dockerfile.evidence
+++ b/release/docker/Dockerfile.evidence
@@ -2,7 +2,7 @@
 
 ARG SOURCE_DATE_EPOCH=0
 
-FROM debian:trixie-slim@sha256:3a39a0592364683e6bab97937b72cad5a8fa6dcbbee90edb3bb48c7f8e94f258 AS runtime-root
+FROM debian:trixie-slim@sha256:d7e12182ce18b85b93007c1dedf31f2d29e01ccf3182cc4017c709b6259bc132 AS runtime-root
 ARG SOURCE_DATE_EPOCH
 
 ADD --checksum=sha256:967aa62605721081c3eb2a17650611a792aa802d76a6511d1840242623d204c9 https://snapshot.debian.org/archive/debian/20260913T000000Z/pool/main/g/glibc/libc6_2.41-12+deb13u4_amd64.deb /workspace/runtime-packages/libc6_2.41-12+deb13u4_amd64.deb
@@ -23,7 +23,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
     && chmod 0700 /workspace/runtime-root/var/lib/registry-evidence/audit \
     && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +
 
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c AS runtime
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime
 
 LABEL org.registrystack.runtime.uid="65532" \
       org.registrystack.runtime.gid="65532"
diff --git a/release/docker/Dockerfile.relay b/release/docker/Dockerfile.relay
index 0f4b0aa79..9abae1f73 100644
--- a/release/docker/Dockerfile.relay
+++ b/release/docker/Dockerfile.relay
@@ -2,7 +2,7 @@
 
 ARG SOURCE_DATE_EPOCH=0
 
-FROM debian:trixie-slim@sha256:3a39a0592364683e6bab97937b72cad5a8fa6dcbbee90edb3bb48c7f8e94f258 AS runtime-root
+FROM debian:trixie-slim@sha256:d7e12182ce18b85b93007c1dedf31f2d29e01ccf3182cc4017c709b6259bc132 AS runtime-root
 ARG SOURCE_DATE_EPOCH
 
 ADD --checksum=sha256:967aa62605721081c3eb2a17650611a792aa802d76a6511d1840242623d204c9 https://snapshot.debian.org/archive/debian/20260913T000000Z/pool/main/g/glibc/libc6_2.41-12+deb13u4_amd64.deb /workspace/runtime-packages/libc6_2.41-12+deb13u4_amd64.deb
@@ -28,7 +28,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
     && chmod 0700 /workspace/runtime-root/var/lib/relay/audit \
     && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +
 
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c AS runtime
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime
 
 LABEL org.registrystack.runtime.uid="65532" \
       org.registrystack.runtime.gid="65532"