diff --git a/Dockerfile.runtime b/Dockerfile.runtime
index f5cf7a1..929f66a 100644
--- a/Dockerfile.runtime
+++ b/Dockerfile.runtime
@@ -28,12 +28,13 @@ RUN apk add --no-cache bash git
 COPY --from=ui /src /src
 WORKDIR /src
 RUN --mount=type=cache,target=/go/pkg/mod \
-    go get google.golang.org/grpc@v1.83.2 github.com/apache/thrift@v0.24.0 golang.org/x/crypto@v0.55.0 golang.org/x/text@v0.41.0 \
+    go get google.golang.org/grpc@v1.83.2 github.com/apache/thrift@v0.24.0 golang.org/x/crypto@v0.57.0 golang.org/x/text@v0.42.0 golang.org/x/net@v0.60.0 \
     && go mod download \
     && test "$(go list -m -f '{{.Version}}' google.golang.org/grpc)" = "v1.83.2" \
     && test "$(go list -m -f '{{.Version}}' github.com/apache/thrift)" = "v0.24.0" \
-    && test "$(go list -m -f '{{.Version}}' golang.org/x/crypto)" = "v0.55.0" \
-    && test "$(go list -m -f '{{.Version}}' golang.org/x/text)" = "v0.41.0"
+    && test "$(go list -m -f '{{.Version}}' golang.org/x/crypto)" = "v0.57.0" \
+    && test "$(go list -m -f '{{.Version}}' golang.org/x/text)" = "v0.42.0" \
+    && test "$(go list -m -f '{{.Version}}' golang.org/x/net)" = "v0.60.0"
 ARG TARGETARCH
 ARG TARGETOS
 RUN --mount=type=cache,target=/go/pkg/mod \
@@ -46,8 +47,9 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 RUN go version -m bin/vault | grep -F "go1.26.9" \
     && go version -m bin/vault | grep -F "google.golang.org/grpc" | grep -F "v1.83.2" \
     && go version -m bin/vault | grep -F "github.com/apache/thrift" | grep -F "v0.24.0" \
-    && go version -m bin/vault | grep -F "golang.org/x/crypto" | grep -F "v0.55.0" \
-    && go version -m bin/vault | grep -F "golang.org/x/text" | grep -F "v0.41.0" \
+    && go version -m bin/vault | grep -F "golang.org/x/crypto" | grep -F "v0.57.0" \
+    && go version -m bin/vault | grep -F "golang.org/x/text" | grep -F "v0.42.0" \
+    && go version -m bin/vault | grep -F "golang.org/x/net" | grep -F "v0.60.0" \
     && go version -m bin/vault | grep -F "github.com/hashicorp/vault/version.Version=${VAULT_VERSION}"
 
 FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
diff --git a/main.go b/main.go
index a3bb2b5..aa2fb13 100644
--- a/main.go
+++ b/main.go
@@ -50,8 +50,8 @@ type Settings struct {
 
 var image = &resources.DockerImage{
 	Name:   "ghcr.io/codefly-dev/service-vault-runtime",
-	Tag:    "runtime-v2.0.3-patched.11",
-	Digest: "sha256:374a30766d5e1f24231c47982c186c9a160e332b950af5f1efc6b6f676c7ea4b",
+	Tag:    "runtime-v2.0.3-patched.13",
+	Digest: "sha256:86aa9162af5494eb7bdd1173773037bb7b4dc3632bdf316b27eb345ca2d47355",
 }
 
 type Service struct {
diff --git a/main_test.go b/main_test.go
index e665657..1e38075 100644
--- a/main_test.go
+++ b/main_test.go
@@ -32,9 +32,9 @@ func TestCreateToRunDocker(t *testing.T) {
 
 func TestVaultImagePin(t *testing.T) {
 	require.Equal(t, "ghcr.io/codefly-dev/service-vault-runtime", image.Name)
-	require.Equal(t, "runtime-v2.0.3-patched.11", image.Tag)
-	require.Equal(t, "sha256:374a30766d5e1f24231c47982c186c9a160e332b950af5f1efc6b6f676c7ea4b", image.Digest)
-	require.Equal(t, "ghcr.io/codefly-dev/service-vault-runtime@sha256:374a30766d5e1f24231c47982c186c9a160e332b950af5f1efc6b6f676c7ea4b", image.FullName())
+	require.Equal(t, "runtime-v2.0.3-patched.13", image.Tag)
+	require.Equal(t, "sha256:86aa9162af5494eb7bdd1173773037bb7b4dc3632bdf316b27eb345ca2d47355", image.Digest)
+	require.Equal(t, "ghcr.io/codefly-dev/service-vault-runtime@sha256:86aa9162af5494eb7bdd1173773037bb7b4dc3632bdf316b27eb345ca2d47355", image.FullName())
 }
 
 // TestAgentVersion asserts the embedded agent identity actually resolves from
@@ -100,6 +100,7 @@ func TestVaultImageSBOM(t *testing.T) {
 	// database later drops an advisory or stops recognizing a Go dependency.
 	for module, version := range map[string]string{
 		"github.com/apache/thrift": "v0.24.0",
+		"golang.org/x/net":         "v0.60.0",
 		"google.golang.org/grpc":   "v1.83.2",
 	} {
 		found := false