diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index a5ea48e..7c98719 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -6,7 +6,7 @@
 # Pinned by digest; Dependabot's docker ecosystem keeps version + digest current together.
 # Same Go line as gitops-reverser, so the two repositories can share code without a toolchain
 # mismatch (the golang image sets GOTOOLCHAIN=local: this Go is the only Go there is).
-FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 AS ci
+FROM golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9 AS ci
 
 ENV DEBIAN_FRONTEND=noninteractive