diff --git a/python/Dockerfile b/python/Dockerfile
index 1af610390..c2c7abb7d 100644
--- a/python/Dockerfile
+++ b/python/Dockerfile
@@ -83,7 +83,7 @@ RUN mkdir -p /staging/config
 # version-numbered tags (only :nonroot/:latest/:debug), so a digest is the only way to pin tighter
 # than "Debian 12". Tag kept for readability; bump the digest via dependency tooling.
 # Digest = multi-arch index resolved via `docker buildx imagetools inspect gcr.io/distroless/cc-debian12:nonroot`.
-FROM gcr.io/distroless/cc-debian12:nonroot@sha256:fccdbb0a547c14e23fcf4ce8ad62ca5d43b4faae8d22cd292f490fef9946c96e
+FROM gcr.io/distroless/cc-debian12:nonroot@sha256:adcd20c7b4c988b73cbfbddb26d2eee574571e6d7c9ffea29b3821e0690efb77
 ARG VERSION
 
 ENV LANG=C.UTF-8