diff --git a/stack/run/Dockerfile b/stack/run/Dockerfile
index 6903614..b086df4 100644
--- a/stack/run/Dockerfile
+++ b/stack/run/Dockerfile
@@ -36,7 +36,7 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get update \
 # never dlopen.  Because distroless has no shell we cannot run rm inside it directly;
 # instead we copy its entire filesystem into /rootfs inside an Ubuntu helper layer,
 # delete the dead-weight files, and hand /rootfs to the scratch stage below.
-FROM gcr.io/distroless/cc:nonroot@sha256:d3cda6e91129130d7229a1806b6a73d292ef245ab032da7851907798024cefba AS distroless-src
+FROM gcr.io/distroless/cc:nonroot@sha256:aded2458d026e046cb68199db0e5793e1028ffa143f7258f3c4278253e20add7 AS distroless-src
 # hadolint ignore=DL3006
 FROM ubuntu:26.04@sha256:b7f48194d4d8b763a478a621cdc81c27be222ba2206ca3ca6bc42b49685f3d9e AS cc-trimmer
 COPY --from=distroless-src / /rootfs/