diff --git a/CHANGELOG.md b/CHANGELOG.md
index 044226b..def4d79 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -128,6 +128,14 @@ useful than saying where the real one is.
   distro group. Driven on WSL 3.0.1 with Ubuntu running: one other distro,
   445.9 MiB, and both test containers with their limit.
 
+### Changed
+
+- **The bundled docker CLI is 29.8.2**, from 29.8.1. amd64 is Docker's own
+  zip, checksum computed from the official download as before; the arm64
+  `docker.exe` is built from docker/cli at commit `7fc2dff`, pinned. Its
+  toolchain moves to Go 1.26.8, in step with the engine. Compose, buildx and
+  the credential helper are unchanged.
+
 ### Fixed
 
 - **Three CodeQL log-injection alerts that a previous fix only claimed to
diff --git a/internal/dockercli/manifest.json b/internal/dockercli/manifest.json
index 10da3ba..edfe1dc 100644
--- a/internal/dockercli/manifest.json
+++ b/internal/dockercli/manifest.json
@@ -39,20 +39,20 @@
   "components": [
     {
       "name": "docker",
-      "version": "29.8.1",
+      "version": "29.8.2",
       "role": "cli",
       "target": "docker.exe",
       "license": "Apache-2.0",
       "licenseURL": "https://raw.githubusercontent.com/docker/cli/master/LICENSE",
       "arch": {
         "amd64": {
-          "url": "https://download.docker.com/win/static/stable/x86_64/docker-29.8.1.zip",
-          "sha256": "f99b6e0ac1950e6c47c267b1d7ac53ef973682208523212d03477478c6562aaf",
+          "url": "https://download.docker.com/win/static/stable/x86_64/docker-29.8.2.zip",
+          "sha256": "e8a956a1f117764dd79f6b1964eca0bb451088fe2db5ecce93ed0e01e5d814b3",
           "zipEntry": "docker/docker.exe"
         },
         "arm64": {
-          "url": "https://github.com/wslkit/skrog/releases/download/dockercli-v29.8.1/docker-29.8.1-windows-arm64.exe",
-          "sha256": "910087c0d9a80ac0e7802f8c48b98cdc7fd890c78e0dab5f0472bee856ac50a0"
+          "url": "",
+          "sha256": ""
         }
       }
     },
diff --git a/third_party/docker-cli/versions.env b/third_party/docker-cli/versions.env
index 9dc624e..bf13d13 100644
--- a/third_party/docker-cli/versions.env
+++ b/third_party/docker-cli/versions.env
@@ -14,8 +14,8 @@
 # internal/dockercli/manifest.json -- the same binary is installed on both
 # architectures and reporting two different versions would be a support
 # nightmare. A test pins the two together.
-DOCKER_CLI_VERSION=29.8.1
-DOCKER_CLI_TAG=v29.8.1
+DOCKER_CLI_VERSION=29.8.2
+DOCKER_CLI_TAG=v29.8.2
 
 # The commit the tag must resolve to (#88). A git tag can be moved and a
 # source repository compromised, and the result is the binary every docker
@@ -23,9 +23,9 @@ DOCKER_CLI_TAG=v29.8.1
 #
 # This is the tag's dereferenced commit (refs/tags/<tag>^{}), not the tag
 # object's own hash.
-DOCKER_CLI_SHA=4a63305d74332de5ceba7fcbccbc3cbb7412f5ba
+DOCKER_CLI_SHA=7fc2dff9bceb96b266a3b2c3117c0955a0d9e616
 
 # Toolchain. Bumping this changes the output, so it is pinned like everything
 # else. Kept in step with guest/rootfs/versions.env so the engine and the CLI
 # are built by the same compiler.
-GO_VERSION=1.26.7
+GO_VERSION=1.26.8