diff --git a/.archive/apps/yagpdb/Dockerfile b/.archive/apps/yagpdb/Dockerfile
index 07678c347..23a2025b6 100644
--- a/.archive/apps/yagpdb/Dockerfile
+++ b/.archive/apps/yagpdb/Dockerfile
@@ -23,7 +23,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build -o /yagpdb -v -ldflags="-X github.com/botl
 
 # Stage 2: Working app image
 #FROM gcr.io/distroless/cc-debian12:nonroot@sha256:6cf8f0fafa8b4b911eefa9be9e2fe40fcf380f56de25d203dd9a3782c255d1f3
-FROM gcr.io/distroless/static-debian12:nonroot@sha256:dcd3f1f09adef5689088c9c4d96a8d98c889d8281d3946145074f89eafe7e1af
+FROM gcr.io/distroless/static-debian12:nonroot@sha256:d71f4b239be2d412017b798a0a401c44c3049a3ca454838473a4c32ed076bfea
 ARG VERSION
 WORKDIR /app
 
diff --git a/apps/caddy-distroless-base/Dockerfile b/apps/caddy-distroless-base/Dockerfile
index 2f22c3777..77d9b2cc8 100644
--- a/apps/caddy-distroless-base/Dockerfile
+++ b/apps/caddy-distroless-base/Dockerfile
@@ -7,7 +7,7 @@ RUN xcaddy build
 RUN setcap -r /usr/bin/caddy
 
 # Stage 2 (App): Use Google's distroless Debian 12 static non-root image as base image for actual app image, and copy compiled Caddy binary
-FROM gcr.io/distroless/static-debian12:nonroot@sha256:dcd3f1f09adef5689088c9c4d96a8d98c889d8281d3946145074f89eafe7e1af
+FROM gcr.io/distroless/static-debian12:nonroot@sha256:d71f4b239be2d412017b798a0a401c44c3049a3ca454838473a4c32ed076bfea
 COPY --chown=1000:1000 --chmod=555 --from=builder /usr/bin/caddy /caddy
 # NOTE: This base image flavour won't set the setcap for NET_BIND_SERVICE yet, so that the fileserver image flavour can launch by default on :8080 without any Linux capabilities
 # Refer to `jjgadgets/caddy` image for a Caddy image that runs on privileged ports (<1024, Caddy uses :80 for HTTP and :443 for HTTPS by default)
diff --git a/apps/goatcounter/Dockerfile b/apps/goatcounter/Dockerfile
index 5d8dd3c54..240e0a34c 100644
--- a/apps/goatcounter/Dockerfile
+++ b/apps/goatcounter/Dockerfile
@@ -10,7 +10,7 @@ ADD https://github.com/arp242/goatcounter/releases/download/v${VERSION}/goatcoun
 RUN gzip -d /goatcounter.gz
 
 # Stage 2: Working app image
-FROM gcr.io/distroless/static-debian12:nonroot@sha256:dcd3f1f09adef5689088c9c4d96a8d98c889d8281d3946145074f89eafe7e1af
+FROM gcr.io/distroless/static-debian12:nonroot@sha256:d71f4b239be2d412017b798a0a401c44c3049a3ca454838473a4c32ed076bfea
 ARG VERSION
 WORKDIR /app
 
diff --git a/apps/gotosocial/Dockerfile b/apps/gotosocial/Dockerfile
index cc376682a..f468be701 100644
--- a/apps/gotosocial/Dockerfile
+++ b/apps/gotosocial/Dockerfile
@@ -6,7 +6,7 @@ ARG VERSION
 FROM docker.io/superseriousbusiness/gotosocial:${VERSION} AS upstream
 
 # Stage 2: Working app image
-FROM gcr.io/distroless/static-debian12:nonroot@sha256:dcd3f1f09adef5689088c9c4d96a8d98c889d8281d3946145074f89eafe7e1af
+FROM gcr.io/distroless/static-debian12:nonroot@sha256:d71f4b239be2d412017b798a0a401c44c3049a3ca454838473a4c32ed076bfea
 WORKDIR /gotosocial
 COPY --chown=1000:1000 --from=upstream /gotosocial /gotosocial
 
diff --git a/apps/rclone/Dockerfile b/apps/rclone/Dockerfile
index 2ab54101a..99ac7c711 100644
--- a/apps/rclone/Dockerfile
+++ b/apps/rclone/Dockerfile
@@ -6,7 +6,7 @@ ARG VERSION
 FROM docker.io/rclone/rclone:${VERSION} AS upstream
 
 # Stage 2: Working app image
-FROM gcr.io/distroless/static-debian12:nonroot@sha256:dcd3f1f09adef5689088c9c4d96a8d98c889d8281d3946145074f89eafe7e1af
+FROM gcr.io/distroless/static-debian12:nonroot@sha256:d71f4b239be2d412017b798a0a401c44c3049a3ca454838473a4c32ed076bfea
 COPY --chown=1000:1000 --from=upstream /usr/local/bin/rclone /rclone
 COPY --from=upstream /etc/fuse.conf /etc/fuse.conf
 ADD --chmod=555 --chown=1000:1000 --checksum=sha256:af8a43230338de67563878a25872ee2fd3d6af0f3513d55dd1ec672ad69dae53 https://github.com/openSUSE/catatonit/releases/download/v0.2.0/catatonit.x86_64 /catatonit