diff --git a/stack/run/Dockerfile b/stack/run/Dockerfile
index b1ed1a3..6903614 100644
--- a/stack/run/Dockerfile
+++ b/stack/run/Dockerfile
@@ -7,7 +7,7 @@
 # Architecture-agnostic: usr/lib/*/ globs cover both amd64 and arm64.
 
 # Stage 1: Ubuntu setup — CNB user/group and tzdata extraction
-FROM ubuntu:26.04@sha256:53958ec7b67c2c9355df922dd08dbf0360611f8c3cdb656875e81873db9ffdba AS ubuntu-setup
+FROM ubuntu:26.04@sha256:b7f48194d4d8b763a478a621cdc81c27be222ba2206ca3ca6bc42b49685f3d9e AS ubuntu-setup
 
 ARG CNB_USER_ID=1002
 ARG CNB_GROUP_ID=1000
@@ -38,7 +38,7 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get update \
 # delete the dead-weight files, and hand /rootfs to the scratch stage below.
 FROM gcr.io/distroless/cc:nonroot@sha256:d3cda6e91129130d7229a1806b6a73d292ef245ab032da7851907798024cefba AS distroless-src
 # hadolint ignore=DL3006
-FROM ubuntu:26.04@sha256:53958ec7b67c2c9355df922dd08dbf0360611f8c3cdb656875e81873db9ffdba AS cc-trimmer
+FROM ubuntu:26.04@sha256:b7f48194d4d8b763a478a621cdc81c27be222ba2206ca3ca6bc42b49685f3d9e AS cc-trimmer
 COPY --from=distroless-src / /rootfs/
 # hadolint ignore=SC2114
 RUN rm -rf \