diff --git a/Dockerfile b/Dockerfile
index d4ea24b..9c33f03 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -42,7 +42,7 @@ COPY --from=prebuilt config.gz /kernel/config.gz
 COPY --from=prebuilt addons.squashfs /kernel/addons.squashfs
 COPY --from=prebuilt metadata /kernel/metadata
 
-FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS sdkbuild-prebuilt
+FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS sdkbuild-prebuilt
 ARG KERNEL_FLAVOR=zone
 COPY --from=prebuilt sdk.tar.gz /sdk.tar.gz
 COPY --from=prebuilt metadata /metadata
diff --git a/Dockerfile.buildenv b/Dockerfile.buildenv
index fa5d78e..fd102ef 100644
--- a/Dockerfile.buildenv
+++ b/Dockerfile.buildenv
@@ -7,7 +7,7 @@
 # a schedule (see .github/workflows/buildenv.yml); the kernel Dockerfile pins
 # it by digest and dependabot proposes bumps as reviewable PRs.
 
-FROM debian:bookworm@sha256:9344f8b8992482f80cba753f323adeaf17690076c095ccff6cc9536be98185dc
+FROM debian:bookworm@sha256:f37a335e82bca302e955fa39f9dfe28f1be618f016f8a2b56318e5a5111afc26
 
 RUN export DEBIAN_FRONTEND=noninteractive && apt-get update && apt-get install -y \
       build-essential squashfs-tools python3-yaml \