diff --git a/Dockerfile b/Dockerfile
index 9a1888f2..412a0553 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,7 @@
 #
 ARG ELIXIR_VERSION=1.20.2
 ARG OTP_VERSION=29.0.3
-ARG DEBIAN_VERSION=trixie-20260713-slim
+ARG DEBIAN_VERSION=trixie-20260518-slim
 
 ARG BUILDER_IMAGE="docker.io/hexpm/elixir:${ELIXIR_VERSION}-erlang-${OTP_VERSION}-debian-${DEBIAN_VERSION}"
 # Prebuilt runtime base contains wgrib2 + cdo + gdal-bin + locale + the
diff --git a/Dockerfile.base b/Dockerfile.base
index b332da69..a3638078 100644
--- a/Dockerfile.base
+++ b/Dockerfile.base
@@ -14,7 +14,7 @@
 # workflow rebuilds and re-tags `:latest`. The app Dockerfile follows
 # `:latest`, so the next app push picks it up automatically.
 
-ARG DEBIAN_VERSION=trixie-20260713-slim
+ARG DEBIAN_VERSION=trixie-20260518-slim
 ARG RUNNER_IMAGE="docker.io/debian:${DEBIAN_VERSION}"
 
 # ---- wgrib2 build stage (cached independently inside this image) ----