diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 6fcd1d4a..67f2f13b 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -6,7 +6,7 @@
   // fresh, correctly detecting the runtime environment (CI, Codespaces, etc.)
   // Pinned by digest only (no tag): the devcontainers CLI cannot parse a
   // combined `:tag@sha256:...` reference, so Renovate keeps just the digest.
-  "image": "ghcr.io/devsecninja/dotfiles-devcontainer@sha256:1bc1c3900aed0c360257bd6a80e2e08d19a3b0d4c05cf11b9f2a1222d5827b30",
+  "image": "ghcr.io/devsecninja/dotfiles-devcontainer@sha256:48cf1106d33039781d183d2bcb2d1449807d234ffb3c9fd03b1fa44e3e25bc8f",
   "features": {
     "ghcr.io/devcontainers/features/git-lfs:1": {
       "version": "latest"