diff --git a/Dockerfile b/Dockerfile
index 5f1d2d0..80c5955 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,7 +6,7 @@
 #
 # The build base is pinned by digest (the tag in the comment is the
 # human-readable equivalent); Dependabot's docker ecosystem bumps both together.
-FROM --platform=$BUILDPLATFORM golang:1.27-bookworm@sha256:648f440f42a0958804efb24df176f806f9d353b41f1c0627f666428e40310f6b AS build
+FROM --platform=$BUILDPLATFORM golang:1.27-bookworm@sha256:69a7b9788769bec032d238959b61854e9ae87f57be9029ec04e9885fabf99195 AS build
 
 # GOTOOLCHAIN=local: never silently download a toolchain other than the one
 # baked into the pinned image. CGO_ENABLED=0: fully static binaries.