diff --git a/Dockerfile b/Dockerfile
index d3afa82..9ca4fc2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,7 +9,7 @@
 # The previous split (a static image plus a separate `-gpu` variant) meant two
 # artifacts, two digests to sign, and a values field to pick between them —
 # for a difference no operator wanted to reason about.
-FROM golang:1.26.8-bookworm@sha256:a688600ca24f8a4d3ca77f95b0dd40704a9fc787c826660eb7ba0b641b8b175d AS builder
+FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 AS builder
 WORKDIR /src
 COPY go.mod go.sum* ./
 RUN go mod download
@@ -22,7 +22,7 @@ ARG VERSION=""
 RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} \
     go build -trimpath -ldflags="-s -w -X main.version=${VERSION}" -tags gpu -o /out/nodevitals ./cmd/nodevitals
 
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:3ee00291cf386ec52a552e6a858d555debd74776eb4bfa53fa3df2cd6677515e
 # Links the ghcr package to this repository, so the image shows up under the
 # repo's Packages and its provenance is traceable from the registry alone.
 LABEL org.opencontainers.image.source=https://github.com/KeiaiLab/nodevitals