diff --git a/Dockerfile b/Dockerfile
index c3737b99..f99a095c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -105,7 +105,7 @@ RUN if [ "$TARGETARCH" = "$BUILDARCH" ]; then \
 # so all deps come from the vendored tree (no network access needed).
 # Base image pinned by digest so the Go toolchain that compiles the static
 # Docker CLI binary cannot change without an explicit Dependabot bump.
-FROM --platform=$BUILDPLATFORM golang:1.26.3-alpine@sha256:91eda9776261207ea25fd06b5b7fed8d397dd2c0a283e77f2ab6e91bfa71079d AS cli-builder
+FROM --platform=$BUILDPLATFORM golang:1.26.4-alpine@sha256:f23e8b227fb4493eabe03bede4d5a32d04092da71962f1fb79b5f7d1e6c2a17f AS cli-builder
 
 ARG TARGETARCH
 
@@ -159,7 +159,7 @@ RUN cp vendor.mod go.mod && cp vendor.sum go.sum && \
 # by compose at all, so this is defense-in-depth rather than a live exposure.
 # Base image pinned by digest (same image as cli-builder above) so both
 # source builds share an identical, immutable Go toolchain.
-FROM --platform=$BUILDPLATFORM golang:1.26.3-alpine@sha256:91eda9776261207ea25fd06b5b7fed8d397dd2c0a283e77f2ab6e91bfa71079d AS compose-builder
+FROM --platform=$BUILDPLATFORM golang:1.26.4-alpine@sha256:f23e8b227fb4493eabe03bede4d5a32d04092da71962f1fb79b5f7d1e6c2a17f AS compose-builder
 
 ARG TARGETARCH