diff --git a/backend/Dockerfile b/backend/Dockerfile
index 5f640e9..fdfc328 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -30,7 +30,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 
 # Runtime stage - distroless for minimal attack surface
 # nonroot variant runs as uid 65532 by default
-FROM gcr.io/distroless/static-debian12:nonroot@sha256:1b7b9f0f0e0a1d2155f531db587cc48ec26aaf97ab64364225f5bf18a054e66a
+FROM gcr.io/distroless/static-debian12:nonroot@sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab
 
 WORKDIR /app