diff --git a/containers/galactic-debug/Dockerfile b/containers/galactic-debug/Dockerfile
index 387c794b..b497331b 100644
--- a/containers/galactic-debug/Dockerfile
+++ b/containers/galactic-debug/Dockerfile
@@ -55,28 +55,20 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} \
       go install "github.com/osrg/gobgp/v4/cmd/gobgp@${GOBGP_VERSION}" \
     && find "$(go env GOPATH)/bin" -name gobgp -exec cp {} /workspace/gobgp \;
 
-FROM nicolaka/netshoot:latest
+FROM nicolaka/netshoot:v0.16@sha256:b09d9b21381f47a79b3cbcb30da25266dc17186ea00ae65e99fdc51396f48e70
 ARG TARGETARCH
-ARG KUBECTL_VERSION=v1.34.0
 ARG CRICTL_VERSION=v1.34.0
 ARG YQ_VERSION=v4.44.3
 
-# bpftool/bpftrace: eBPF map/prog introspection, which nodes do not
-# otherwise provide, for dumping galactic-cni's usid_egress and
-# egress_route_table maps directly.
+# bpftool: eBPF map/prog introspection, which nodes do not otherwise
+# provide, for dumping galactic-cni's usid_egress and egress_route_table
+# maps directly.
 # frr: ships vtysh, for querying fabric-router's FRR instance directly.
 RUN apk add --no-cache \
       bpftool \
-      bpftrace \
       frr
 
-# kubectl: correlating with the EndpointSlice state that drives
-# vpc-vrf-sidecar's route installs.
-RUN curl -fsSL "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl" \
-      -o /usr/local/bin/kubectl \
-    && chmod +x /usr/local/bin/kubectl
-
-# crictl: CRI-level container/pod inspection alongside kubectl.
+# crictl: CRI-level container/pod inspection.
 RUN curl -fsSL "https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-${TARGETARCH}.tar.gz" \
     | tar xz -C /usr/local/bin
 
diff --git a/containers/galactic-debug/README.md b/containers/galactic-debug/README.md
index e2b5886d..788dfaa3 100644
--- a/containers/galactic-debug/README.md
+++ b/containers/galactic-debug/README.md
@@ -4,8 +4,11 @@ An incident-response toolbox image, built on `nicolaka/netshoot` plus the
 tools that debugging Galactic's datapath and routing needs and netshoot
 doesn't already have: `bpftool`, `vtysh` (FRR client), the `gobgp` CLI,
 `crictl`, `yq`, and `galactic-usid` (this repo's base62/hex uSID codec,
-`cmd/galactic-usid`). The image also ships `kubectl` and `bpftrace`, which
-don't work from a debug pod today (see [What doesn't work](#what-doesnt-work)).
+`cmd/galactic-usid`).
+
+The image has no `kubectl`: a node debug pod runs as its namespace's
+`default` service account, which has no RBAC. It has no `bpftrace` either,
+because the pod doesn't mount tracefs. Run `kubectl` from your workstation.
 
 Published as `ghcr.io/datum-cloud/galactic-debug`. Not deployed as a
 standing workload: attach it on demand as a node debug pod.
@@ -48,8 +51,6 @@ kubectl -n galactic-system exec -it <debug-pod> -- bash
   kubectl -n galactic-system delete pod <debug-pod>
   ```
 
-Run `kubectl` from your workstation, not from inside the pod.
-
 ## Inside the pod
 
 The pod sits in the host network namespace, but its filesystem is the
@@ -112,13 +113,6 @@ without changing the target pod. Some workloads (Kata, Unikraft) sit
 behind a tap interface: from the host you see the host-side interface,
 never the guest.
 
-## What doesn't work
-
-| Tool       | Why                                                                                                                            | Tracked in                                                   |
-| ---------- | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------ |
-| `kubectl`  | The pod runs as the namespace's `default` service account, which has no RBAC. Run `kubectl` from your workstation              | [#1158](https://github.com/datum-cloud/galactic/issues/1158) |
-| `bpftrace` | Needs tracefs, which the pod doesn't mount. Even with `mount -t tracefs tracefs /sys/kernel/tracing` it isn't verified to work | [#1158](https://github.com/datum-cloud/galactic/issues/1158) |
-
 ## Known caveats to re-check every time
 
 - **A service reachable through more than one region needs testing in
@@ -147,6 +141,9 @@ never the guest.
 version `galactic-router` embeds (`go.mod`'s `github.com/osrg/gobgp/v4`).
 Renovate bumps both in the same pull request.
 
-`KUBECTL_VERSION`/`CRICTL_VERSION`/`YQ_VERSION` build args pin the rest;
-bump periodically, roughly tracking the Kubernetes minor version of the
-Galactic edge clusters the image is used on.
+The `nicolaka/netshoot` base is pinned by tag and digest, so every build of
+a commit gets the same base. Renovate proposes base updates.
+
+`CRICTL_VERSION`/`YQ_VERSION` build args pin the rest; bump periodically,
+roughly tracking the Kubernetes minor version of the Galactic edge clusters
+the image is used on.