diff --git a/caddy.Dockerfile b/caddy.Dockerfile
index 8428aef0..0daf6870 100644
--- a/caddy.Dockerfile
+++ b/caddy.Dockerfile
@@ -57,7 +57,7 @@
 #       Verify the LB is `externalTrafficPolicy: Local` + the parent
 #       Caddy's `trustedProxies` covers the LB CIDR range.
 
-FROM caddy:2.11.3-builder@sha256:f96a3b748f2ce4e5f6595453615da734b93993b231213fe35d0673893b5613ef AS builder
+FROM caddy:2.11.4-builder@sha256:f2b98918658f949a3c533f2c73bd0806e3f2576ccf8eb182c8b1690c977007ea AS builder
 
 RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
     --mount=type=cache,target=/root/.cache,sharing=locked \
@@ -71,7 +71,7 @@ RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
 # when versions disagree). If this fails the RUN exits non-zero with the
 # failing command visible — no misleading prefixed echo.
 
-FROM caddy:2.11.3@sha256:ec18ee54aab3315c22e25f3b2babda73ff8007d39b13b3bd1bfffa2f0444c7d9
+FROM caddy:2.11.4@sha256:cb9d71ad83182011b79355cd57692686374bd78d6fe327efe0ff8507da03ab13
 
 RUN apk update && apk upgrade --no-cache && rm -rf /var/cache/apk/*