diff --git a/images/Dockerfile.bread-22.04 b/images/Dockerfile.bread-22.04
index 972b72a..a2de923 100644
--- a/images/Dockerfile.bread-22.04
+++ b/images/Dockerfile.bread-22.04
@@ -1,6 +1,6 @@
 # Bread image: Ubuntu 22.04 + sshd only.
 
-FROM docker.io/library/ubuntu:22.04@sha256:829f6df217bcbae2b371026e81711d1a787c61b2967ad09d015063663ebafbf7
+FROM docker.io/library/ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02
 
 ARG APT_MIRROR=
 
diff --git a/images/Dockerfile.bread-24.04 b/images/Dockerfile.bread-24.04
index 7553b4f..d3e5c4a 100644
--- a/images/Dockerfile.bread-24.04
+++ b/images/Dockerfile.bread-24.04
@@ -1,6 +1,6 @@
 # Bread image: Ubuntu 24.04 + sshd only.
 
-FROM docker.io/library/ubuntu:24.04@sha256:224a1869083a311ef3f13648a154ba79832fbef6364d31493642ca03082da254
+FROM docker.io/library/ubuntu:24.04@sha256:008173c23f95b170204355c12626cb5a965d779a7e1283b09e9cffbb1bf33ca3
 
 ARG APT_MIRROR=
 
diff --git a/images/Dockerfile.bread-26.04 b/images/Dockerfile.bread-26.04
index 8db13b3..04dfd20 100644
--- a/images/Dockerfile.bread-26.04
+++ b/images/Dockerfile.bread-26.04
@@ -1,6 +1,6 @@
 # Bread image: Ubuntu 26.04 + sshd only.
 
-FROM docker.io/library/ubuntu:26.04@sha256:513c074113a871b51a8d16ab445c88779d6452d937a164fb5cc479f32668a41d
+FROM docker.io/library/ubuntu:26.04@sha256:da6fc2be547864451aa253836dd926da33623312df4a9a243e35dc877c378a78
 
 ARG APT_MIRROR=
 
diff --git a/images/Dockerfile.bread-26.10 b/images/Dockerfile.bread-26.10
index 0a5bc4c..638c280 100644
--- a/images/Dockerfile.bread-26.10
+++ b/images/Dockerfile.bread-26.10
@@ -1,6 +1,6 @@
 # Bread image: Ubuntu 26.10 + sshd only.
 
-FROM docker.io/library/ubuntu:26.10@sha256:49077a16b772f8bc6e6f160ad2bfc218919f3455037387ed19a8309174328603 AS base
+FROM docker.io/library/ubuntu:26.10@sha256:ee126c2fa0249079a7e24ae3a3d29b04783ef93ab33c868751c9a1289d3fffff AS base
 
 ARG APT_MIRROR=
 
@@ -48,7 +48,7 @@ RUN chmod 0755 /usr/local/bin/bread-tar-shim && \
 # seccomp shim for sshd, inert unless the host's emulation refuses seccomp
 # filters. See hack/seccomp-shim.c. Cross-compiled on the build platform, from
 # the same pin as the base above (hack/check_base.sh moves both).
-FROM --platform=$BUILDPLATFORM docker.io/library/ubuntu:26.10@sha256:49077a16b772f8bc6e6f160ad2bfc218919f3455037387ed19a8309174328603 AS seccomp-shim
+FROM --platform=$BUILDPLATFORM docker.io/library/ubuntu:26.10@sha256:ee126c2fa0249079a7e24ae3a3d29b04783ef93ab33c868751c9a1289d3fffff AS seccomp-shim
 ARG APT_MIRROR=
 RUN --mount=type=bind,source=hack/apt-mirror.sh,target=/usr/local/bin/bread-apt-mirror \
     --mount=type=tmpfs,target=/run/apt-mirror \