diff --git a/Dockerfile.go-server b/Dockerfile.go-server
index f4e0d45dd..b7d33e6c6 100644
--- a/Dockerfile.go-server
+++ b/Dockerfile.go-server
@@ -120,7 +120,7 @@ RUN mkdir -p /dist/lib /dist/bin /dist/model \
 # ---------------------------------------------------------------------------
 # Stage 3 — go-server: distroless runtime (glibc, no shell)
 # ---------------------------------------------------------------------------
-FROM gcr.io/distroless/cc-debian12@sha256:d703b626ba455c4e6c6fbe5f36e6f427c85d51445598d564652a2f334179f96e AS go-server
+FROM gcr.io/distroless/cc-debian12@sha256:e8e7ee4b8b106d4c5fde9e422a321b2b8a2d5cca546c97adcce927f3e1d36e36 AS go-server
 
 LABEL org.opencontainers.image.title="vmafx-server"
 LABEL org.opencontainers.image.description="VMAFX scoring server — Go gRPC + HTTP, backed by libvmaf"
diff --git a/docker/Dockerfile.controller b/docker/Dockerfile.controller
index e8fd878e8..c6ffc8867 100644
--- a/docker/Dockerfile.controller
+++ b/docker/Dockerfile.controller
@@ -105,7 +105,7 @@ RUN mkdir -p /dist/lib /dist/bin /dist/model \
 # ---------------------------------------------------------------------------
 # Stage 3 — controller: distroless runtime (glibc, no shell)
 # ---------------------------------------------------------------------------
-FROM gcr.io/distroless/cc-debian12@sha256:d703b626ba455c4e6c6fbe5f36e6f427c85d51445598d564652a2f334179f96e AS controller
+FROM gcr.io/distroless/cc-debian12@sha256:e8e7ee4b8b106d4c5fde9e422a321b2b8a2d5cca546c97adcce927f3e1d36e36 AS controller
 
 LABEL org.opencontainers.image.title="vmafx-controller"
 LABEL org.opencontainers.image.description="VMAFX controller — distributed job queue + node registry, gRPC + HTTP, backed by libvmaf"
diff --git a/docker/Dockerfile.node b/docker/Dockerfile.node
index db685e6fb..7743d95f9 100644
--- a/docker/Dockerfile.node
+++ b/docker/Dockerfile.node
@@ -221,7 +221,7 @@ RUN CGO_ENABLED=${CGO_ENABLED} \
 # ---------------------------------------------------------------------------
 # Stage 5 — runtime-base: glibc runtime foundation
 # ---------------------------------------------------------------------------
-FROM gcr.io/distroless/cc-debian12@sha256:d703b626ba455c4e6c6fbe5f36e6f427c85d51445598d564652a2f334179f96e AS runtime-base
+FROM gcr.io/distroless/cc-debian12@sha256:e8e7ee4b8b106d4c5fde9e422a321b2b8a2d5cca546c97adcce927f3e1d36e36 AS runtime-base
 
 LABEL org.opencontainers.image.title="vmafx-node"
 LABEL org.opencontainers.image.description="VMAFX worker node — ffmpeg n8.2 + libvmaf + vmafx-node gRPC service"
diff --git a/docker/Dockerfile.production b/docker/Dockerfile.production
index 691c4d256..d0c6eccf4 100644
--- a/docker/Dockerfile.production
+++ b/docker/Dockerfile.production
@@ -96,7 +96,7 @@ RUN pip install --no-cache-dir \
 # ---------------------------------------------------------------------------
 # Stage 3 — runtime-base: shared runtime layer (no shell, distroless)
 # ---------------------------------------------------------------------------
-FROM gcr.io/distroless/cc-debian12@sha256:d703b626ba455c4e6c6fbe5f36e6f427c85d51445598d564652a2f334179f96e AS runtime-base
+FROM gcr.io/distroless/cc-debian12@sha256:e8e7ee4b8b106d4c5fde9e422a321b2b8a2d5cca546c97adcce927f3e1d36e36 AS runtime-base
 
 # OCI image labels — version baked in at build time via CI; left as
 # placeholders here so local builds still produce labelled images.
diff --git a/docker/Dockerfile.production-gpu b/docker/Dockerfile.production-gpu
index 5a60b7c5f..ee8f07a55 100644
--- a/docker/Dockerfile.production-gpu
+++ b/docker/Dockerfile.production-gpu
@@ -154,7 +154,7 @@ RUN --mount=type=cache,target=/root/.cache/ccache,sharing=locked,id=ccache-oneap
 # ---------------------------------------------------------------------------
 # Runtime base — distroless cc-debian12
 # ---------------------------------------------------------------------------
-FROM gcr.io/distroless/cc-debian12@sha256:d703b626ba455c4e6c6fbe5f36e6f427c85d51445598d564652a2f334179f96e AS runtime-base
+FROM gcr.io/distroless/cc-debian12@sha256:e8e7ee4b8b106d4c5fde9e422a321b2b8a2d5cca546c97adcce927f3e1d36e36 AS runtime-base
 
 LABEL org.opencontainers.image.title="vmafx"
 LABEL org.opencontainers.image.description="VMAFX production GPU runtime"