diff --git a/images/bitwarden-backup/Dockerfile b/images/bitwarden-backup/Dockerfile
index 1b644cf..aaab3be 100644
--- a/images/bitwarden-backup/Dockerfile
+++ b/images/bitwarden-backup/Dockerfile
@@ -1,4 +1,4 @@
-FROM chainguard/wolfi-base:latest@sha256:0b613d8101fae27cf76186351db831ab3db25bfb2ec7161e897cd7e22c6413a3
+FROM chainguard/wolfi-base:latest@sha256:9c2092b053779e14c82fb50f77b37bcc38b7d2c83972352d5813280f9d035b03
 
 # renovate: datasource=github-releases depName=bitwarden/clients extractVersion=^cli-v(?<version>.+)$
 ARG BW_VERSION=2026.5.0
diff --git a/images/odysseus-ai/Dockerfile b/images/odysseus-ai/Dockerfile
index 0444f3c..0fde0b4 100644
--- a/images/odysseus-ai/Dockerfile
+++ b/images/odysseus-ai/Dockerfile
@@ -9,7 +9,7 @@
 ARG ODYSSEUS_SHA=934d23c0be29c9721385f34565c0ae2cbd60da04
 
 # ---- pinned upstream checkout ----
-FROM chainguard/wolfi-base:latest@sha256:0b613d8101fae27cf76186351db831ab3db25bfb2ec7161e897cd7e22c6413a3 AS src
+FROM chainguard/wolfi-base:latest@sha256:9c2092b053779e14c82fb50f77b37bcc38b7d2c83972352d5813280f9d035b03 AS src
 ARG ODYSSEUS_SHA
 RUN apk add --no-cache git \
     && git clone https://github.com/odysseus-dev/odysseus.git /src \
@@ -18,7 +18,7 @@ RUN apk add --no-cache git \
     && rm -rf .git
 
 # ---- kagi-cli binary ----
-FROM chainguard/wolfi-base:latest@sha256:0b613d8101fae27cf76186351db831ab3db25bfb2ec7161e897cd7e22c6413a3 AS kagi-fetch
+FROM chainguard/wolfi-base:latest@sha256:9c2092b053779e14c82fb50f77b37bcc38b7d2c83972352d5813280f9d035b03 AS kagi-fetch
 
 # renovate: datasource=github-releases depName=Microock/kagi-cli extractVersion=^v(?<version>.+)$
 ARG KAGI_VERSION=0.16.0