diff --git a/docker/gitea/1/debian12/1.22/Dockerfile b/docker/gitea/1/debian12/1.22/Dockerfile
index d92feaeac6..15c64e3e62 100644
--- a/docker/gitea/1/debian12/1.22/Dockerfile
+++ b/docker/gitea/1/debian12/1.22/Dockerfile
@@ -1,5 +1,5 @@
 ARG BASE_REGISTRY="docker.io"
-FROM marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861 as ospo
+FROM marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0 as ospo
 
 # Download Licenses and restricted source-code
 COPY components.csv /components.csv
@@ -17,7 +17,7 @@ RUN mkdir -p /usr/src/licenses \
 		&& /download-ref-repos.sh /source_code.txt /usr/src
 
 #Build stage
-FROM docker.io/golang:bookworm AS build-env
+FROM docker.io/library/golang:1.25-bookworm AS build-env
 
 ARG GOPROXY
 ENV GOPROXY ${GOPROXY:-direct}
@@ -49,7 +49,7 @@ RUN make clean-all build
 
 # Begin env-to-ini build
 RUN go build contrib/environment-to-ini/environment-to-ini.go
-FROM marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
+FROM marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0
 
 COPY --from=ospo /usr/src /usr/src
 
@@ -64,7 +64,9 @@ RUN apt-get update && \
         openssh-server \
         s6 \
         sqlite3 \
-        gnupg
+        gnupg \
+    && apt-get install -y --only-upgrade perl zlib1g \
+    && rm -rf /var/lib/apt/lists/*
 
 RUN ln -s /usr/lib/x86_64-linux-musl/libc.so /lib/libc.musl-x86_64.so.1 \
     &&  ssh-keygen -A \
diff --git a/docker/gitea/1/debian12/1.23/Dockerfile b/docker/gitea/1/debian12/1.23/Dockerfile
index 8ff99201eb..29ebf18dc5 100644
--- a/docker/gitea/1/debian12/1.23/Dockerfile
+++ b/docker/gitea/1/debian12/1.23/Dockerfile
@@ -1,5 +1,5 @@
 ARG BASE_REGISTRY="docker.io"
-FROM marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861 as ospo
+FROM marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0 as ospo
 
 # Download Licenses and restricted source-code
 COPY components.csv /components.csv
@@ -17,7 +17,7 @@ RUN mkdir -p /usr/src/licenses \
 		&& /download-ref-repos.sh /source_code.txt /usr/src
 
 #Build stage
-FROM docker.io/golang:bookworm AS build-env
+FROM docker.io/library/golang:1.25-bookworm AS build-env
 
 ARG GOPROXY
 ENV GOPROXY ${GOPROXY:-direct}
@@ -49,7 +49,7 @@ RUN make clean-all build
 
 # Begin env-to-ini build
 RUN go build contrib/environment-to-ini/environment-to-ini.go
-FROM marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
+FROM marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0
 
 COPY --from=ospo /usr/src /usr/src
 
@@ -64,7 +64,9 @@ RUN apt-get update && \
         openssh-server \
         s6 \
         sqlite3 \
-        gnupg
+        gnupg \
+    && apt-get install -y --only-upgrade perl zlib1g \
+    && rm -rf /var/lib/apt/lists/*
 
 RUN ln -s /usr/lib/x86_64-linux-musl/libc.so /lib/libc.musl-x86_64.so.1 \
     &&  ssh-keygen -A \
diff --git a/docker/gitea/1/debian12/1.25/Dockerfile b/docker/gitea/1/debian12/1.25/Dockerfile
index 2a0e952bd3..822746e217 100644
--- a/docker/gitea/1/debian12/1.25/Dockerfile
+++ b/docker/gitea/1/debian12/1.25/Dockerfile
@@ -1,5 +1,5 @@
 ARG BASE_REGISTRY="docker.io"
-FROM marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861 as ospo
+FROM marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0 as ospo
 
 # Download Licenses and restricted source-code
 COPY components.csv /components.csv
@@ -17,7 +17,7 @@ RUN mkdir -p /usr/src/licenses \
 		&& /download-ref-repos.sh /source_code.txt /usr/src
 
 #Build stage
-FROM docker.io/golang:bookworm AS build-env
+FROM docker.io/library/golang:1.25-bookworm AS build-env
 
 ARG GOPROXY
 ENV GOPROXY ${GOPROXY:-direct}
@@ -49,7 +49,7 @@ RUN make clean-all build
 
 # Begin env-to-ini build
 RUN go build contrib/environment-to-ini/environment-to-ini.go
-FROM marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
+FROM marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0
 
 COPY --from=ospo /usr/src /usr/src
 
@@ -64,7 +64,9 @@ RUN apt-get update && \
         openssh-server \
         s6 \
         sqlite3 \
-        gnupg
+        gnupg \
+    && apt-get install -y --only-upgrade perl zlib1g \
+    && rm -rf /var/lib/apt/lists/*
 
 RUN ln -s /usr/lib/x86_64-linux-musl/libc.so /lib/libc.musl-x86_64.so.1 \
     &&  ssh-keygen -A \
diff --git a/docker/gitea/templates/Dockerfile.template b/docker/gitea/templates/Dockerfile.template
index e4077c92c4..70f3b5cfe8 100644
--- a/docker/gitea/templates/Dockerfile.template
+++ b/docker/gitea/templates/Dockerfile.template
@@ -21,7 +21,7 @@ RUN mkdir -p /usr/src/licenses \
 		&& /download-ref-repos.sh /source_code.txt /usr/src
 
 #Build stage
-FROM docker.io/golang:bookworm AS build-env
+FROM docker.io/library/golang:{{ $golang.Version }}-bookworm AS build-env
 
 ARG GOPROXY
 ENV GOPROXY ${GOPROXY:-direct}
@@ -68,7 +68,9 @@ RUN apt-get update && \
         openssh-server \
         s6 \
         sqlite3 \
-        gnupg
+        gnupg \
+    && apt-get install -y --only-upgrade perl zlib1g \
+    && rm -rf /var/lib/apt/lists/*
 
 RUN ln -s /usr/lib/x86_64-linux-musl/libc.so /lib/libc.musl-x86_64.so.1 \
     &&  ssh-keygen -A \
diff --git a/docker/gitea/versions.yaml b/docker/gitea/versions.yaml
index b766ee6a7d..f917d7c370 100644
--- a/docker/gitea/versions.yaml
+++ b/docker/gitea/versions.yaml
@@ -27,12 +27,12 @@ versions:
   - key: com.googleapis.cloudmarketplace.product.service.name
     value: services/83c38401-9081-4bfd-8d88-f247f9c37ce9.cloudpartnerservices.goog
   dir: 1/debian12/1.25
-  from: marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
+  from: marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0
   packages:
     gitea:
       version: '1.25'
     golang:
-      version: '1.23'
+      version: '1.25'
     nodejs:
       major: '22'
   repo: gitea1
@@ -56,12 +56,12 @@ versions:
   - key: com.googleapis.cloudmarketplace.product.service.name
     value: services/83c38401-9081-4bfd-8d88-f247f9c37ce9.cloudpartnerservices.goog
   dir: 1/debian12/1.23
-  from: marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
+  from: marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0
   packages:
     gitea:
       version: '1.23'
     golang:
-      version: '1.23'
+      version: '1.25'
     nodejs:
       major: '20'
   repo: gitea1
@@ -82,12 +82,12 @@ versions:
   - key: com.googleapis.cloudmarketplace.product.service.name
     value: services/83c38401-9081-4bfd-8d88-f247f9c37ce9.cloudpartnerservices.goog
   dir: 1/debian12/1.22
-  from: marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
+  from: marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0
   packages:
     gitea:
       version: '1.22'
     golang:
-      version: '1.23'
+      version: '1.25'
     nodejs:
       major: '20'
   repo: gitea1