diff --git a/.devcontainer/Containerfile b/.devcontainer/Containerfile
index 8e45dcb0f..a3fd915d3 100644
--- a/.devcontainer/Containerfile
+++ b/.devcontainer/Containerfile
@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/devcontainers/base:2.1.13-bookworm@sha256:73d85a96694a2cadca1ba3fcb5721f2312a64f1d571dd86f6c77e10a708931dc
+FROM mcr.microsoft.com/devcontainers/base:2.1.15-bookworm@sha256:86165cfc170e9b2aa8df90b847127eea97b08eb9987021e6e6ec6c3a96545d7c
 
 ENV PYTHONUNBUFFERED=True
 ENV UV_LINK_MODE=copy
diff --git a/controller/Containerfile b/controller/Containerfile
index 846e4d340..d332b7ff6 100644
--- a/controller/Containerfile
+++ b/controller/Containerfile
@@ -49,7 +49,7 @@ RUN  --mount=type=cache,target=/opt/app-root/src/go/pkg/mod,sharing=locked,uid=1
      -ldflags "-X main.version=${GIT_VERSION} -X main.gitCommit=${GIT_COMMIT} -X main.buildDate=${BUILD_DATE}" \
      -o router ./cmd/router
 
-FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1786321990@sha256:7e7f79ab747bf2b452e3043dd89f388e92be4c7fdcc8b815b58adf6c99c39c95
+FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1787778798@sha256:f332c99eb8f798a8486821c91937f10ad64ee83d7e739303be2df051040918f6
 WORKDIR /
 COPY --from=builder /build/manager .
 COPY --from=builder /build/router  .
diff --git a/controller/Containerfile.exporter-set-controller b/controller/Containerfile.exporter-set-controller
index 136a468ed..1d6951585 100644
--- a/controller/Containerfile.exporter-set-controller
+++ b/controller/Containerfile.exporter-set-controller
@@ -35,7 +35,7 @@ RUN --mount=type=cache,target=/opt/app-root/src/go/pkg/mod,sharing=locked,uid=10
     -ldflags "-X main.version=${GIT_VERSION} -X main.gitCommit=${GIT_COMMIT} -X main.buildDate=${BUILD_DATE}" \
     -o exporter-set-controller cmd/exporter-set-controller/main.go
 
-FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1786321990@sha256:7e7f79ab747bf2b452e3043dd89f388e92be4c7fdcc8b815b58adf6c99c39c95
+FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1787778798@sha256:f332c99eb8f798a8486821c91937f10ad64ee83d7e739303be2df051040918f6
 WORKDIR /
 COPY --from=builder /build/exporter-set-controller .
 USER 65532:65532
diff --git a/controller/Containerfile.operator b/controller/Containerfile.operator
index 1e4b72415..3623f8ac6 100644
--- a/controller/Containerfile.operator
+++ b/controller/Containerfile.operator
@@ -41,7 +41,7 @@ RUN --mount=type=cache,target=/opt/app-root/src/go/pkg/mod,sharing=locked,uid=10
     -ldflags "-X main.version=${GIT_VERSION} -X main.gitCommit=${GIT_COMMIT} -X main.buildDate=${BUILD_DATE}" \
     -o manager cmd/main.go
 
-FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1786321990@sha256:7e7f79ab747bf2b452e3043dd89f388e92be4c7fdcc8b815b58adf6c99c39c95
+FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1787778798@sha256:f332c99eb8f798a8486821c91937f10ad64ee83d7e739303be2df051040918f6
 WORKDIR /
 COPY --from=builder /opt/app-root/src/deploy/operator/manager .
 USER 65532:65532
diff --git a/controller/Containerfile.prebuilt b/controller/Containerfile.prebuilt
index 59b9755ae..5f3fcfb6b 100644
--- a/controller/Containerfile.prebuilt
+++ b/controller/Containerfile.prebuilt
@@ -3,7 +3,7 @@
 # BIN selects which binary becomes the default entrypoint.
 # COPY ${BIN} /entrypoint works because COPY supports ARG expansion,
 # while ENTRYPOINT does not (and ubi-micro has no shell for shell-form).
-FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1786321990@sha256:7e7f79ab747bf2b452e3043dd89f388e92be4c7fdcc8b815b58adf6c99c39c95
+FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1787778798@sha256:f332c99eb8f798a8486821c91937f10ad64ee83d7e739303be2df051040918f6
 ARG BIN
 WORKDIR /
 COPY . .
diff --git a/python/Containerfile b/python/Containerfile
index 1735f5ba0..d584f9bff 100644
--- a/python/Containerfile
+++ b/python/Containerfile
@@ -32,7 +32,7 @@ RUN ARCH=$(uname -m) && \
 
 # Build the jumpstarter-exec Rust binary for the sidecar remote-exec bridge.
 # Uses UBI 10 + rust-toolset for Red Hat-supported toolchain and glibc compatibility.
-FROM registry.access.redhat.com/ubi10/ubi:latest@sha256:145a2d6e7e224d34fbe601832e3f133c11560e15b4074fad75c449387bb105a0 AS rust-builder
+FROM registry.access.redhat.com/ubi10/ubi:latest@sha256:4690398669a07627339936c9e79b05233053056ce688efeb4400d3c1c530486b AS rust-builder
 # GIT_VERSION is already passed as a build-arg by CI (see build-images.yaml)
 # for hatch-vcs; forward it into the Rust build so jumpstarter-exec's
 # build.rs can embed the same version (see rust/jumpstarter-exec/build.rs).