diff --git a/stack/run/Dockerfile b/stack/run/Dockerfile
index b086df4..5a6b824 100644
--- a/stack/run/Dockerfile
+++ b/stack/run/Dockerfile
@@ -36,7 +36,7 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get update \
 # never dlopen.  Because distroless has no shell we cannot run rm inside it directly;
 # instead we copy its entire filesystem into /rootfs inside an Ubuntu helper layer,
 # delete the dead-weight files, and hand /rootfs to the scratch stage below.
-FROM gcr.io/distroless/cc:nonroot@sha256:aded2458d026e046cb68199db0e5793e1028ffa143f7258f3c4278253e20add7 AS distroless-src
+FROM gcr.io/distroless/cc:nonroot@sha256:d97bc0a941b8d4be647dc0ee75b264ddbb772f1ac5ba690a4309c00723b23775 AS distroless-src
 # hadolint ignore=DL3006
 FROM ubuntu:26.04@sha256:b7f48194d4d8b763a478a621cdc81c27be222ba2206ca3ca6bc42b49685f3d9e AS cc-trimmer
 COPY --from=distroless-src / /rootfs/