diff --git a/Dockerfile b/Dockerfile
index a9afa66..0a34e71 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,7 +2,7 @@
 #   docker build -t navkit . && docker run --rm navkit
 # Pinned by digest, so the image a build uses cannot change under it. The tag says what the digest is;
 # Dependabot proposes the next digest, and the container job in CI rebuilds the image to check it.
-FROM python:3.13-slim@sha256:bf44cdfcb76cd3b41e879bc058fc37ec5872002ccfde7fcb765e218cde0cd79c
+FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170
 
 ENV PIP_NO_CACHE_DIR=1 PYTHONDONTWRITEBYTECODE=1
 WORKDIR /work