diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml
index d995d4f2a76f..e618fd5c85ac 100644
--- a/.github/workflows/build-binaries.yml
+++ b/.github/workflows/build-binaries.yml
@@ -229,7 +229,7 @@ jobs:
           # puts that directory on PATH so CMD can exec `stackstate-cluster-agent`
           # by name. Flattening it to a bare binary breaks the image.
           cp -r bin/stackstate-cluster-agent Dockerfiles/cluster-agent/
-          docker build -t "${LOCAL_IMAGE}" Dockerfiles/cluster-agent
+          docker build --pull -t "${LOCAL_IMAGE}" Dockerfiles/cluster-agent
 
       - name: Smoke test cluster-agent image
         run: |
diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml
index 825037edee99..6cea8a3f95ed 100644
--- a/.github/workflows/build-deb.yml
+++ b/.github/workflows/build-deb.yml
@@ -313,7 +313,7 @@ jobs:
           cp "${debs[0]}" Dockerfiles/agent/
           # publish_image.sh also passes --build-arg S6_ARCH; the agent Dockerfile
           # declares no such ARG, so it is dropped here rather than kept as a warning.
-          docker build --build-arg ARCH="${ARCH}" -t "${LOCAL_IMAGE}" Dockerfiles/agent
+          docker build --pull --build-arg ARCH="${ARCH}" -t "${LOCAL_IMAGE}" Dockerfiles/agent
 
       - name: Smoke test agent image
         run: |
diff --git a/AGENTS.md b/AGENTS.md
index aeb226e590a2..9fc1607dc889 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -175,7 +175,7 @@ Go build tags control feature inclusion, some examples are:
 - Release automation workflows
 
 ### Contributing
-PRs should follow `.github/PULL_REQUEST_TEMPLATE.md` and the guidelines in
+PRs should follow the guidelines in
 `docs/public/guidelines/` (contributing, coding style, components, etc.). When
 a PR changes behavior, configuration options, or APIs, update the corresponding
 documentation in the same PR — not as a follow-up.
diff --git a/deps/curl/BUILD.bazel b/deps/curl/BUILD.bazel
index 8b09f725c069..42b418295cc5 100644
--- a/deps/curl/BUILD.bazel
+++ b/deps/curl/BUILD.bazel
@@ -1,13 +1,13 @@
 load("@bazel_skylib//rules:diff_test.bzl", "diff_test")
 load("//bazel/tools:generate_module_bazel.bzl", "generate_module_bazel")
 
-VERSION = "8.21.0"
+VERSION = "8.22.0"
 
 generate_module_bazel(
     name = "curl_module_bazel_new",
     out = "curl.MODULE.bazel.new",
     module = "curl",
-    sha256 = "d9b327997999045a24cda50f3983e69e51c516bd8be6ef9842fc7f99135e33bb",
+    sha256 = "d54dd598bf05927a726deb38df31c6a255ba83ff1de57c5d1464dac3ed8f44a1",
     strip_prefix = "curl-%s" % VERSION,
     tags = ["manual"],
     target_compatible_with = ["@platforms//os:linux"],
diff --git a/deps/curl/Makefile b/deps/curl/Makefile
index 05659f24cccd..080fd8eaf086 100644
--- a/deps/curl/Makefile
+++ b/deps/curl/Makefile
@@ -6,7 +6,7 @@
 # A tool to look at configure output and create parts to support bazel targets
 C2B=$(HOME)/ws/experimental/teams/agent-supply-chain/configure2bazel
 
-PRISTINE=curl-8.18.0
+PRISTINE=curl-8.22.0
 
 next:
 	echo Do both steps on each platform.
diff --git a/deps/curl/curl.MODULE.bazel b/deps/curl/curl.MODULE.bazel
index 6fd0a53d7ea9..6f0a6c0b29e6 100644
--- a/deps/curl/curl.MODULE.bazel
+++ b/deps/curl/curl.MODULE.bazel
@@ -10,7 +10,7 @@ http_archive(
         "lib_contents.bzl": "//deps/curl:overlay/lib_contents.bzl",
         "linux/lib/curl_config.h": "//deps/curl:overlay/linux/lib/curl_config.h",
     },
-    sha256 = "d9b327997999045a24cda50f3983e69e51c516bd8be6ef9842fc7f99135e33bb",
-    strip_prefix = "curl-8.21.0",
-    url = "https://curl.haxx.se/download/curl-8.21.0.tar.gz",
+    sha256 = "d54dd598bf05927a726deb38df31c6a255ba83ff1de57c5d1464dac3ed8f44a1",
+    strip_prefix = "curl-8.22.0",
+    url = "https://curl.haxx.se/download/curl-8.22.0.tar.gz",
 )
diff --git a/deps/curl/overlay/lib_contents.bzl b/deps/curl/overlay/lib_contents.bzl
index d1b18fc7adf9..dcfd52245a5b 100644
--- a/deps/curl/overlay/lib_contents.bzl
+++ b/deps/curl/overlay/lib_contents.bzl
@@ -18,12 +18,16 @@ PUBLIC_HDRS = [
 
 HDRS = [
     "lib/altsvc.h",
+    "lib/api.h",
+    "lib/curl_ed25519.h",
+    "lib/http_httpsig.h",
+    "lib/uint-hashset.h",
     "lib/amigaos.h",
     "lib/arpa_telnet.h",
-    "lib/asyn.h",
+    "lib/vdns/asyn.h",
     "lib/bufq.h",
     "lib/bufref.h",
-    "lib/cf-dns.h",
+    "lib/vdns/cf-dns.h",
     "lib/cf-h1-proxy.h",
     "lib/cf-h2-proxy.h",
     "lib/cf-haproxy.h",
@@ -35,7 +39,6 @@ HDRS = [
     "lib/cfilters.h",
     "lib/config-mac.h",
     "lib/config-os400.h",
-    "lib/config-riscos.h",
     "lib/config-win32.h",
     "lib/conncache.h",
     "lib/connect.h",
@@ -89,8 +92,8 @@ HDRS = [
     "lib/cw-out.h",
     "lib/cw-pause.h",
     "lib/dict.h",
-    "lib/dnscache.h",
-    "lib/doh.h",
+    "lib/vdns/dnscache.h",
+    "lib/vdns/doh.h",
     "lib/dynhds.h",
     "lib/easy_lock.h",
     "lib/easyif.h",
@@ -108,7 +111,7 @@ HDRS = [
     "lib/gopher.h",
     "lib/hash.h",
     "lib/headers.h",
-    "lib/hostip.h",
+    "lib/vdns/hostip.h",
     "lib/hsts.h",
     "lib/http_aws_sigv4.h",
     "lib/http_chunks.h",
@@ -119,7 +122,7 @@ HDRS = [
     "lib/http.h",
     "lib/http1.h",
     "lib/http2.h",
-    "lib/httpsrr.h",
+    "lib/vdns/httpsrr.h",
     "lib/idn.h",
     "lib/if2ip.h",
     "lib/imap.h",
@@ -368,13 +371,17 @@ LIB_CURLTOOL_SRCS_LINUX = [
 
 LIB_CURLU_SRCS_DARWIN = [
     "lib/altsvc.c",
+    "lib/api.c",
+    "lib/curl_ed25519.c",
+    "lib/http_httpsig.c",
+    "lib/uint-hashset.c",
     "lib/amigaos.c",
-    "lib/asyn-ares.c",
-    "lib/asyn-base.c",
-    "lib/asyn-thrdd.c",
+    "lib/vdns/asyn-ares.c",
+    "lib/vdns/asyn-base.c",
+    "lib/vdns/asyn-thrdd.c",
     "lib/bufq.c",
     "lib/bufref.c",
-    "lib/cf-dns.c",
+    "lib/vdns/cf-dns.c",
     "lib/cf-h1-proxy.c",
     "lib/cf-h2-proxy.c",
     "lib/cf-haproxy.c",
@@ -426,8 +433,8 @@ LIB_CURLU_SRCS_DARWIN = [
     "lib/cw-out.c",
     "lib/cw-pause.c",
     "lib/dict.c",
-    "lib/dnscache.c",
-    "lib/doh.c",
+    "lib/vdns/dnscache.c",
+    "lib/vdns/doh.c",
     "lib/dynhds.c",
     "lib/easy.c",
     "lib/easygetopt.c",
@@ -445,9 +452,9 @@ LIB_CURLU_SRCS_DARWIN = [
     "lib/hash.c",
     "lib/headers.c",
     "lib/hmac.c",
-    "lib/hostip.c",
-    "lib/hostip4.c",
-    "lib/hostip6.c",
+    "lib/vdns/hostip.c",
+    "lib/vdns/hostip4.c",
+    "lib/vdns/hostip6.c",
     "lib/hsts.c",
     "lib/http_aws_sigv4.c",
     "lib/http_chunks.c",
@@ -458,7 +465,7 @@ LIB_CURLU_SRCS_DARWIN = [
     "lib/http.c",
     "lib/http1.c",
     "lib/http2.c",
-    "lib/httpsrr.c",
+    "lib/vdns/httpsrr.c",
     "lib/idn.c",
     "lib/if2ip.c",
     "lib/imap.c",
@@ -550,13 +557,17 @@ LIB_CURLU_SRCS_DARWIN = [
 
 LIB_CURLU_SRCS_LINUX = [
     "lib/altsvc.c",
+    "lib/api.c",
+    "lib/curl_ed25519.c",
+    "lib/http_httpsig.c",
+    "lib/uint-hashset.c",
     "lib/amigaos.c",
-    "lib/asyn-ares.c",
-    "lib/asyn-base.c",
-    "lib/asyn-thrdd.c",
+    "lib/vdns/asyn-ares.c",
+    "lib/vdns/asyn-base.c",
+    "lib/vdns/asyn-thrdd.c",
     "lib/bufq.c",
     "lib/bufref.c",
-    "lib/cf-dns.c",
+    "lib/vdns/cf-dns.c",
     "lib/cf-h1-proxy.c",
     "lib/cf-h2-proxy.c",
     "lib/cf-haproxy.c",
@@ -608,8 +619,8 @@ LIB_CURLU_SRCS_LINUX = [
     "lib/cw-out.c",
     "lib/cw-pause.c",
     "lib/dict.c",
-    "lib/dnscache.c",
-    "lib/doh.c",
+    "lib/vdns/dnscache.c",
+    "lib/vdns/doh.c",
     "lib/dynhds.c",
     "lib/easy.c",
     "lib/easygetopt.c",
@@ -627,9 +638,9 @@ LIB_CURLU_SRCS_LINUX = [
     "lib/hash.c",
     "lib/headers.c",
     "lib/hmac.c",
-    "lib/hostip.c",
-    "lib/hostip4.c",
-    "lib/hostip6.c",
+    "lib/vdns/hostip.c",
+    "lib/vdns/hostip4.c",
+    "lib/vdns/hostip6.c",
     "lib/hsts.c",
     "lib/http_aws_sigv4.c",
     "lib/http_chunks.c",
@@ -640,7 +651,7 @@ LIB_CURLU_SRCS_LINUX = [
     "lib/http.c",
     "lib/http1.c",
     "lib/http2.c",
-    "lib/httpsrr.c",
+    "lib/vdns/httpsrr.c",
     "lib/idn.c",
     "lib/if2ip.c",
     "lib/imap.c",
diff --git a/deps/curl/overlay/overlay.BUILD.bazel b/deps/curl/overlay/overlay.BUILD.bazel
index f5bf258d0305..1f1c09d0e561 100644
--- a/deps/curl/overlay/overlay.BUILD.bazel
+++ b/deps/curl/overlay/overlay.BUILD.bazel
@@ -21,8 +21,6 @@ package(
     default_visibility = ["@@//packages:__subpackages__"],
 )
 
-VERSION = "8.18.0"
-
 SO_VERSION = "4.8.0"
 
 license(
@@ -33,8 +31,6 @@ license(
     visibility = ["//visibility:public"],
 )
 
-SONAME = "libcurl.so.%s" % VERSION
-
 PUBLIC_HEADERS = [
     "include/curl/curl.h",
     "include/curl/curlver.h",
@@ -66,7 +62,11 @@ LOCAL_DEFINES = [
     "SM4_ASM",
     "VPAES_ASM",
     "VPSM4_ASM",
-]
+] + select({
+    # Match configure.ac: glibc extension prototypes require this feature macro.
+    "@platforms//os:linux": ["_GNU_SOURCE"],
+    "//conditions:default": [],
+})
 
 copy_file(
     name = "copy_config_h",
diff --git a/docs/dev/stac-24773-bazel-migration.md b/docs/dev/stac-24773-bazel-migration.md
index dcd32d5c15ca..e40b3f35ead4 100644
--- a/docs/dev/stac-24773-bazel-migration.md
+++ b/docs/dev/stac-24773-bazel-migration.md
@@ -49,6 +49,16 @@ Also pass `flavor_flag` (`--//packages/agent:flavor=fips` or heroku) where upstr
 
 ## Core patterns
 
+### Cache ownership
+
+Keep `always_build true` in `datadog-agent-dependencies.rb`. Omnibus fingerprints
+its Ruby recipes, but does not track the Bazel dependency manifests and overlays.
+The stage must invoke Bazel on every package build so Bazel can validate its own
+cache against those inputs. After a native dependency update, verify the version
+inside the resulting DEB or image, including when Omnibus restores a warm cache.
+Image builds using mutable base tags must pull those tags before building so
+cached base images do not hide distribution security updates.
+
 ### Shared libraries → `install` + `replace_prefix`
 
 **Do not** ship Bazel-built `.so` files only via `//packages/agent/dependencies:install` / `pkg_filegroup all_files` if they need to live under `/opt/stackstate-agent/embedded/lib` with embedded RPATH. That failed omnibus health check (C2 pipeline 2619669055): `DT_NEEDED` pointed at system `/lib` for `libz` / `liblzma`.
diff --git a/omnibus/config/software/datadog-agent-dependencies.rb b/omnibus/config/software/datadog-agent-dependencies.rb
index dee1d9be3d2f..a63de21e7db3 100644
--- a/omnibus/config/software/datadog-agent-dependencies.rb
+++ b/omnibus/config/software/datadog-agent-dependencies.rb
@@ -1,6 +1,9 @@
 name 'datadog-agent-dependencies'
 
-description "Enforce building dependencies as soon as possible so they can be cached"
+description "Build and install the Bazel-managed agent dependencies"
+
+# Omnibus does not fingerprint Bazel inputs; let Bazel validate its own cache.
+always_build true
 
 # [sts] STAC-24773: Bazel migration. The remaining `dependency '...'` lines below
 # (jmxfetch, libpcap, systemd, snmp-traps, procps-ng) are progressively replaced by
diff --git a/omnibus/package-scripts/publish_image.sh b/omnibus/package-scripts/publish_image.sh
index 1858c971bf67..1483b2d2fb6b 100755
--- a/omnibus/package-scripts/publish_image.sh
+++ b/omnibus/package-scripts/publish_image.sh
@@ -20,7 +20,7 @@ BUILD_TAG="${IMAGE_REPO}:${IMAGE_TAG}"
 docker login -u "${quay_user}" -p "${quay_password}" "${REGISTRY}"
 docker login -u "${REGISTRY_USER}" -p "${REGISTRY_PASSWORD}" "${REGISTRY_HOST}"
 
-docker build --build-arg ARCH="${ARCH}" --build-arg S6_ARCH="${S6_ARCH}" -t "${BUILD_TAG}" "${DOCKERFILE_PATH}"
+docker build --pull --build-arg ARCH="${ARCH}" --build-arg S6_ARCH="${S6_ARCH}" -t "${BUILD_TAG}" "${DOCKERFILE_PATH}"
 
 
 DOCKER_TAG="${REGISTRY}/${ORGANIZATION}/${IMAGE_REPO}:${IMAGE_TAG}"
diff --git a/releasenotes/notes/curl-8-22-0-7385f21bfe471ecc.yaml b/releasenotes/notes/curl-8-22-0-7385f21bfe471ecc.yaml
new file mode 100644
index 000000000000..3d92a211d4ea
--- /dev/null
+++ b/releasenotes/notes/curl-8-22-0-7385f21bfe471ecc.yaml
@@ -0,0 +1,4 @@
+---
+security:
+  - |
+    Update embedded curl to 8.22.0.