diff --git a/sops/container.go b/sops/container.go
index 1b5dfcc7..8de646c7 100644
--- a/sops/container.go
+++ b/sops/container.go
@@ -29,7 +29,7 @@ var ageSHA256 = map[string]string{
 // are used from it, but "latest" alone changes underneath every run. Renovate
 // moves the digest.
 // renovate: datasource=docker depName=cgr.dev/chainguard/wolfi-base
-const baseImageTag = "latest@sha256:238642d42c5613936474d00b900c4e65fb6f637d8991c913403ff09a09cf43a3"
+const baseImageTag = "latest@sha256:d69a74aa929a006d05880a9287fbbf89aa278d55d7239955331f239122824ba6"
 
 const defaultBaseImage = "cgr.dev/chainguard/wolfi-base:" + baseImageTag