diff --git a/Containerfile b/Containerfile
index 389f128..f6cb38d 100644
--- a/Containerfile
+++ b/Containerfile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.26.5@sha256:ae5a2316d12f3e78fd99177dad452e6ad4f240af2d71d57b480c3477f250fec6 AS builder
+FROM golang:1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365 AS builder
 
 # Optional Go build tags (e.g. "otel" for OpenTelemetry support).
 # Default (empty) produces a standard build without optional features.
diff --git a/Containerfile.cli-stack.rh b/Containerfile.cli-stack.rh
index 51c64fa..355290e 100644
--- a/Containerfile.cli-stack.rh
+++ b/Containerfile.cli-stack.rh
@@ -1,4 +1,4 @@
-FROM registry.redhat.io/ubi9/go-toolset:9.8-1784190466@sha256:f99dd81b20e5971ef9f63a51ac27cf0aa591ff9921d021490548b67fd9b17144 AS build-cross-platform
+FROM registry.redhat.io/ubi9/go-toolset:9.8-1786023237@sha256:5d26ff5606bd6590930e7cfc202b510e3fe2c7a7a1720860f444ab49c45128cb AS build-cross-platform
 ENV APP_ROOT=/opt/app-root \
     GOPATH=/opt/app-root
 
@@ -18,7 +18,7 @@ FROM --platform=linux/arm64   quay.io/securesign/model-transparency-go@sha256:f5
 FROM --platform=linux/ppc64le quay.io/securesign/model-transparency-go@sha256:f5e33ee623166a55366fc0af116cb8171cbefcddd1df02828a49b00e796c1745 AS build-ppc64le
 FROM --platform=linux/s390x   quay.io/securesign/model-transparency-go@sha256:f5e33ee623166a55366fc0af116cb8171cbefcddd1df02828a49b00e796c1745 AS build-s390x
 
-FROM registry.redhat.io/ubi9/go-toolset:9.8-1784190466@sha256:f99dd81b20e5971ef9f63a51ac27cf0aa591ff9921d021490548b67fd9b17144 AS packager
+FROM registry.redhat.io/ubi9/go-toolset:9.8-1786023237@sha256:5d26ff5606bd6590930e7cfc202b510e3fe2c7a7a1720860f444ab49c45128cb AS packager
 USER root
 RUN mkdir -p /binaries
 
@@ -89,7 +89,7 @@ RUN tar -czf /binaries/model_transparency_cli_windows_amd64.exe.gz -C /tmp model
 RUN chmod -R a+rX /binaries
 
 # Final minimal image with all binaries
-FROM registry.redhat.io/ubi9/ubi-micro:9.8-1782840931@sha256:35de56a9413112f1474e392ebc35e0cf6f0fb484c8e8877bbae59b513694b41f
+FROM registry.redhat.io/ubi9/ubi-micro:9.8-1784702951@sha256:b1e86b97028b8fcfb6d85f997c39e6b6b67496163ef8d80d243220a4918e8bef
 
 LABEL description="Flat image containing model-transparency CLI binaries for all platforms and architectures"
 LABEL io.k8s.description="Flat image containing model-transparency CLI binaries for all platforms and architectures"
diff --git a/Containerfile.model-transparency-go.rh b/Containerfile.model-transparency-go.rh
index 026b972..2984de9 100644
--- a/Containerfile.model-transparency-go.rh
+++ b/Containerfile.model-transparency-go.rh
@@ -1,4 +1,4 @@
-FROM registry.redhat.io/ubi9/go-toolset:9.8-1784190466@sha256:f99dd81b20e5971ef9f63a51ac27cf0aa591ff9921d021490548b67fd9b17144 AS build-env
+FROM registry.redhat.io/ubi9/go-toolset:9.8-1786023237@sha256:5d26ff5606bd6590930e7cfc202b510e3fe2c7a7a1720860f444ab49c45128cb AS build-env
 
 ARG BUILD_TAGS=""
 
@@ -38,7 +38,7 @@ RUN set -euo pipefail; \
     git update-index --no-assume-unchanged Containerfile.model-transparency-go.rh; \
     git update-index --no-assume-unchanged Containerfile.cli-stack.rh
 
-FROM registry.redhat.io/ubi9-minimal@sha256:062c52ff973065752b0965787649db2bcf551a6c727a00e95a3eb42cebadbdab
+FROM registry.redhat.io/ubi9-minimal@sha256:dd334afa72444fa46238fcf9e6bd399245adf746378735348cf84b9dfdca38f1
 
 COPY --from=build-env /opt/app-root/src/model_transparency_cli /usr/local/bin/model_transparency_cli
 COPY --from=build-env /opt/app-root/src/model_transparency_cli_linux /usr/local/bin/model_transparency_cli_linux
diff --git a/Containerfile.pkcs11 b/Containerfile.pkcs11
index 8d444d8..51ad8bc 100644
--- a/Containerfile.pkcs11
+++ b/Containerfile.pkcs11
@@ -19,7 +19,7 @@
 # For hardware HSMs, bind-mount your vendor's PKCS#11 module at runtime
 # and pass the module path via --pkcs11-uri module-path attribute.
 
-FROM golang:1.26.5@sha256:ae5a2316d12f3e78fd99177dad452e6ad4f240af2d71d57b480c3477f250fec6 AS builder
+FROM golang:1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365 AS builder
 
 # Optional Go build tags (e.g. "otel" for OpenTelemetry support).
 # Default (empty) produces a standard build without optional features.