diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index d518304..bc987aa 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,3 +1,3 @@
 # The devcontainer's base image, pinned by digest. It lives in a Dockerfile so
 # Dependabot's docker ecosystem can bump the digest (#244).
-FROM mcr.microsoft.com/devcontainers/go:1.26-bookworm@sha256:f848c0d10256ec05e45b0d84a7f3eb1cf33ec1f6c6b4a596ae66aa081018b6ff
+FROM mcr.microsoft.com/devcontainers/go:2.3-bookworm@sha256:75a84cbeca74acadcebf7df05777c77d6ade353a26c0a3ce55fc4b13bdad69cd
diff --git a/.devcontainer/labs/Dockerfile b/.devcontainer/labs/Dockerfile
index bbd3ac9..214d5b5 100644
--- a/.devcontainer/labs/Dockerfile
+++ b/.devcontainer/labs/Dockerfile
@@ -1,3 +1,3 @@
 # The labs devcontainer's base image, pinned by digest. It lives in a
 # Dockerfile so Dependabot's docker ecosystem can bump the digest (#244).
-FROM mcr.microsoft.com/devcontainers/go:1.26-bookworm@sha256:f848c0d10256ec05e45b0d84a7f3eb1cf33ec1f6c6b4a596ae66aa081018b6ff
+FROM mcr.microsoft.com/devcontainers/go:2.3-bookworm@sha256:75a84cbeca74acadcebf7df05777c77d6ade353a26c0a3ce55fc4b13bdad69cd
diff --git a/Dockerfile b/Dockerfile
index 8dac3e1..d133e93 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,7 +2,7 @@
 # minimum); Dependabot keeps both digests fresh. It runs on the build host's
 # platform and cross-compiles for the target, so multi-arch images (#40) need
 # no QEMU emulation.
-FROM --platform=$BUILDPLATFORM golang:1.27.3-alpine@sha256:fa3d596898d9f126af7c01d14ee7597bab3f39cccf392ef36b69fe77cd681f18 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.27.4-alpine@sha256:0a5f7fe796599ff487605987432e7619ae45beeb2fba4c2ce0b907879932aebf AS builder
 
 # Set by BuildKit for each platform being built.
 ARG TARGETOS
@@ -32,7 +32,7 @@ COPY examples/labs/*.zone examples/labs/words.txt ./examples/labs/
 # Build the binary with optimizations
 RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -o subenum -ldflags="-w -s -X main.Version=${VERSION}" .
 
-FROM gcr.io/distroless/static:nonroot@sha256:25ac8f0c3b2334a9eb05452266bd4697864a8c8ef0ef71e5e6480d7f92868329
+FROM gcr.io/distroless/static:nonroot@sha256:aafe993665bf6200db38a02c11a9351e782a84b6a45e7f33b6695638c88e3931
 
 WORKDIR /home/nonroot