diff --git a/Dockerfile b/Dockerfile
index 9b8786c..c7bf923 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,6 @@
 # syntax=docker/dockerfile:1
-FROM --platform=$BUILDPLATFORM golang:1.27-trixie AS build
+# Base images are pinned by digest; Renovate updates them.
+FROM --platform=$BUILDPLATFORM golang:1.27-trixie@sha256:2f84bc93ecfb2689f782b153fdcd368b5a7ab96c1386c65cdaccf35e726d6a44 AS build
 ARG TARGETOS TARGETARCH VERSION=dev
 WORKDIR /src
 COPY go.mod go.sum ./
@@ -10,10 +11,12 @@ RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -trimpath \
     -ldflags "-s -w -X github.com/virtbase/proxbase/internal/cli.version=${VERSION}" \
     -o /out/proxbase ./cmd/proxbase
 
-FROM debian:trixie-slim
+FROM debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
 # Extra apt options for difficult networks, e.g. --build-arg APT_OPTS="-o Acquire::ForceIPv4=true"
 ARG APT_OPTS=""
+# upgrade: security fixes released after the base image
 RUN apt-get update $APT_OPTS \
+ && apt-get upgrade -y -o Acquire::Retries=3 $APT_OPTS \
  && apt-get install -y --no-install-recommends -o Acquire::Retries=3 $APT_OPTS qemu-system-x86 qemu-utils ca-certificates openssh-client tini \
  && rm -rf /var/lib/apt/lists/*
 # Runs as uid 1000; /dev/kvm access comes from the host (group_add the kvm GID).
diff --git a/Dockerfile.release b/Dockerfile.release
index d15ec93..91120c2 100644
--- a/Dockerfile.release
+++ b/Dockerfile.release
@@ -1,9 +1,12 @@
 # Image built by GoReleaser from the release binaries (see Dockerfile for source builds).
-FROM debian:trixie-slim
+# The base image is pinned by digest; Renovate updates it.
+FROM debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
 ARG TARGETPLATFORM
 # Extra apt options for difficult networks, e.g. --build-arg APT_OPTS="-o Acquire::ForceIPv4=true"
 ARG APT_OPTS=""
+# upgrade: security fixes released after the base image
 RUN apt-get update $APT_OPTS \
+ && apt-get upgrade -y -o Acquire::Retries=3 $APT_OPTS \
  && apt-get install -y --no-install-recommends -o Acquire::Retries=3 $APT_OPTS qemu-system-x86 qemu-utils ca-certificates openssh-client tini \
  && rm -rf /var/lib/apt/lists/*
 RUN useradd --uid 1000 --create-home proxbase && mkdir -p /data && chown proxbase:proxbase /data
diff --git a/osv-scanner.toml b/osv-scanner.toml
new file mode 100644
index 0000000..df541dd
--- /dev/null
+++ b/osv-scanner.toml
@@ -0,0 +1,6 @@
+# Known vulnerabilities that do not affect Proxbase (read by OSV-Scanner and the
+# OpenSSF Scorecard). Review when golang.org/x/crypto changes.
+
+[[IgnoredVulns]]
+id = "GO-2026-5932"
+reason = "Affects golang.org/x/crypto/openpgp, which Proxbase does not import; govulncheck reports it as not called. The package is deprecated and has no fixed version."