diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 8e5d88f..0131d80 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,6 +1,6 @@
 {
   "name": "IPAM",
-  "image": "mcr.microsoft.com/devcontainers/go:1-1.24-bookworm",
+  "image": "mcr.microsoft.com/devcontainers/go:1.26-trixie",
 
   // docker-in-docker rather than a postgres service: internal/testdb starts its
   // own container, so the fixture resolves its backend identically here, on a
diff --git a/Dockerfile b/Dockerfile
index ffac6da..28c54ac 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # Build stage. Debian-based so the race detector (which requires CGO + glibc)
 # can be enabled via --build-arg RACE=-race.
-FROM --platform=$BUILDPLATFORM golang:1.26-bookworm AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26-trixie AS builder
 
 # Build arguments for version injection
 ARG VERSION=dev
@@ -57,7 +57,7 @@ RUN if [ -n "$RACE" ]; then \
 
 # Runtime stage. distroless/base ships glibc so it works for both the default
 # CGO_ENABLED=0 static build and the CGO_ENABLED=1 race build.
-FROM gcr.io/distroless/base-debian12:nonroot
+FROM gcr.io/distroless/base-debian13:nonroot
 
 WORKDIR /
 COPY --from=builder /workspace/ipam .