diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 8f47d47f..3779bcd1 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,6 +1,6 @@
 {
   "name": "Kubebuilder DevContainer",
-  "image": "golang:1.27.3@sha256:0c050feb47802ae436b9030833694a0b80160d08e3b3049ad30bf7c9e724e09d",
+  "image": "golang:1.27.3@sha256:e519d3b0a5b285e5aa53ab9eef02bc6bbb9cb04608389b743a136a9ce75f0d1e",
   "features": {
     "ghcr.io/devcontainers/features/docker-in-docker:4": {
       "moby": false,
diff --git a/Dockerfile b/Dockerfile
index 41d53cf8..01fadade 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.27.3@sha256:0c050feb47802ae436b9030833694a0b80160d08e3b3049ad30bf7c9e724e09d AS builder
+FROM golang:1.27.3@sha256:e519d3b0a5b285e5aa53ab9eef02bc6bbb9cb04608389b743a136a9ce75f0d1e AS builder
 ARG TARGETOS
 ARG TARGETARCH
 # VERSION-01: build-stamped version (internal/version), passed via --build-arg at release time.
diff --git a/Dockerfile.pipeline b/Dockerfile.pipeline
index 994b5355..bd6a7b34 100644
--- a/Dockerfile.pipeline
+++ b/Dockerfile.pipeline
@@ -1,7 +1,7 @@
 # Build the kollect-pipeline CLI binary (ADR-0801 pipeline mode).
 # Same source tree, builder image, and hardening posture as the operator Dockerfile;
 # only the entrypoint (./cmd/cli vs ./cmd) and runtime base differ.
-FROM golang:1.27.3@sha256:0c050feb47802ae436b9030833694a0b80160d08e3b3049ad30bf7c9e724e09d AS builder
+FROM golang:1.27.3@sha256:e519d3b0a5b285e5aa53ab9eef02bc6bbb9cb04608389b743a136a9ce75f0d1e AS builder
 ARG TARGETOS
 ARG TARGETARCH
 # VERSION-01: build-stamped version (internal/version), passed via --build-arg at release time.