diff --git a/Dockerfile b/Dockerfile
index f016816..828e8ed 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,7 +14,7 @@ RUN apk add --no-cache aws-cli gomplate
 # OpenTofu >= 1.10 — the service inits its S3 backend with use_lockfile=true,
 # which needs tofu 1.10+. alpine only packages 1.7.x, so pull the official
 # static binary for the build arch.
-ARG TOFU_VERSION=1.10.10
+ARG TOFU_VERSION=1.12.6
 ARG TARGETARCH
 RUN curl -fsSL "https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_linux_${TARGETARCH}.tar.gz" \
       | tar -xz -C /usr/local/bin tofu \