diff --git a/utils/docker/Dockerfile.jammy b/utils/docker/Dockerfile.jammy
index 003d8c798..a2428c1d9 100644
--- a/utils/docker/Dockerfile.jammy
+++ b/utils/docker/Dockerfile.jammy
@@ -15,6 +15,8 @@ RUN --mount=type=secret,id=pipconf,target=/etc/pip.conf,required=false \
     find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \
       -exec sed -i "s|http://archive.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}archive.ubuntu.com|g; s|http://ports.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}ports.ubuntu.com|g" {} + && \
     apt-get update && \
+    # Pick up security fixes that the base image does not have yet.
+    apt-get upgrade -y && \
     # Install Python
     apt-get install -y python3 python3-distutils curl && \
     update-alternatives --install /usr/bin/python python /usr/bin/python3 1 && \
diff --git a/utils/docker/Dockerfile.noble b/utils/docker/Dockerfile.noble
index 699a624ba..fcd686bf2 100644
--- a/utils/docker/Dockerfile.noble
+++ b/utils/docker/Dockerfile.noble
@@ -15,6 +15,8 @@ RUN --mount=type=secret,id=pipconf,target=/etc/pip.conf,required=false \
     find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \
       -exec sed -i "s|http://archive.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}archive.ubuntu.com|g; s|http://ports.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}ports.ubuntu.com|g" {} + && \
     apt-get update && \
+    # Pick up security fixes that the base image does not have yet.
+    apt-get upgrade -y && \
     # Install Python
     apt-get install -y python3 curl && \
     # Align with upstream Python image and don't be externally managed:
diff --git a/utils/docker/Dockerfile.resolute b/utils/docker/Dockerfile.resolute
index 3c8b64eef..c8911634e 100644
--- a/utils/docker/Dockerfile.resolute
+++ b/utils/docker/Dockerfile.resolute
@@ -15,6 +15,8 @@ RUN --mount=type=secret,id=pipconf,target=/etc/pip.conf,required=false \
     find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \
       -exec sed -i "s|http://archive.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}archive.ubuntu.com|g; s|http://ports.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}ports.ubuntu.com|g" {} + && \
     apt-get update && \
+    # Pick up security fixes that the base image does not have yet.
+    apt-get upgrade -y && \
     # Install Python
     apt-get install -y python3 curl && \
     # Align with upstream Python image and don't be externally managed: