diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index 38f26c30..1a49d45e 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -273,7 +273,7 @@ jobs:
         # rootlesskit-docker-proxy is no longer used since Docker v28.
         #
         # The design of netns handling was changed in Docker v29.5.
-        docker_version: [27.5.1, 29.4.3, 29.5.2]
+        docker_version: [27.5.1, 29.4.3, 29.8.0]
     steps:
     - name: "Set up AppArmor"
       run: |
diff --git a/Dockerfile b/Dockerfile
index ee5093f3..511f3d90 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,10 @@
 ARG GO_VERSION=1.26
 ARG UBUNTU_VERSION=24.04
-ARG SHADOW_VERSION=4.17.4
-ARG SLIRP4NETNS_VERSION=v1.3.4
+ARG SHADOW_VERSION=4.20.2
+ARG SLIRP4NETNS_VERSION=v1.3.5
 ARG VPNKIT_VERSION=0.6.0
 ARG PASST_VERSION=2026_07_28.f8df3f1
-ARG DOCKER_VERSION=29.5.2
+ARG DOCKER_VERSION=29.8.0
 ARG DOCKER_CHANNEL=stable
 
 FROM golang:${GO_VERSION}-alpine AS build
@@ -44,7 +44,7 @@ RUN git clone https://github.com/shadow-maint/shadow.git /shadow
 WORKDIR /shadow
 ARG SHADOW_VERSION
 RUN git pull && git checkout $SHADOW_VERSION
-RUN ./autogen.sh --disable-nls --disable-man --without-audit --without-selinux --without-acl --without-attr --without-tcb --without-nscd && \
+RUN ./autogen.sh --disable-nls --disable-man --without-audit --without-selinux --without-acl --without-attr --without-tcb && \
   make && \
   cp src/newuidmap src/newgidmap /usr/bin