diff --git a/src/codeprobe/sandbox/Dockerfile.scoring b/src/codeprobe/sandbox/Dockerfile.scoring
index 7c77d318..f9c116c7 100644
--- a/src/codeprobe/sandbox/Dockerfile.scoring
+++ b/src/codeprobe/sandbox/Dockerfile.scoring
@@ -6,7 +6,7 @@
 # bash, git, and coreutils for the scripts themselves. Scoring containers
 # run with --network=none: nothing in this image may assume network egress
 # at runtime, and mined tests that need it fail closed by design.
-FROM debian:bookworm-slim@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818
+FROM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251
 
 ARG DEBIAN_SNAPSHOT=20260728T000000Z