diff --git a/docker/Dockerfile b/docker/Dockerfile
index aa9813b..02fd62f 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -14,7 +14,7 @@
 # Debian SDK that RESEARCH.md C3 originally recommended — the -r RID flag
 # determines the publish target, not the build host's libc. Empirically verified
 # 2026-04-27: docker build succeeded on amd64 producing a 106 MB runtime image.)
-FROM mcr.microsoft.com/dotnet/sdk:10.0-alpine@sha256:5c559aa5d99337e400d39ab4fa1f6979d126c29b20939d53658ed38300571e74 AS build
+FROM mcr.microsoft.com/dotnet/sdk:10.0-alpine@sha256:fac7cce841f78faa4bca416fb4c636d1a129c09abd9b50e9b45664b95fd008a0 AS build
 
 # BuildKit TARGETARCH is injected by `docker buildx build --platform linux/amd64|arm64`.
 # Map Docker arch names to .NET musl RIDs.