diff --git a/controller/Dockerfile b/controller/Dockerfile
index 7c6f7d7b..911250f0 100644
--- a/controller/Dockerfile
+++ b/controller/Dockerfile
@@ -20,7 +20,7 @@ ARG CI_FLEET_COMMIT=unknown
 RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.version=${CI_FLEET_VERSION} -X main.commitSHA=${CI_FLEET_COMMIT}" -o /out/ci-fleet-controller . \
     && touch -d "@${SOURCE_DATE_EPOCH}" /out/ci-fleet-controller
 
-FROM debian:13.7-slim@sha256:62bd423aeee912639ca8ee681c2b762cb3e25137e0a92b20be455898a9f034ad
+FROM debian:13.7-slim@sha256:f6b08b09a05725f9431502d3b5714f5c4576e82c1a84fa1debe0c24a7e0c3ec4
 ARG SOURCE_DATE_EPOCH=1786752000
 ARG DEBIAN_SNAPSHOT=20261012T000000Z
 ARG CI_FLEET_COMMIT=unknown
diff --git a/docs/MANAGED-IMAGES.md b/docs/MANAGED-IMAGES.md
index 19ed599e..be78931d 100644
--- a/docs/MANAGED-IMAGES.md
+++ b/docs/MANAGED-IMAGES.md
@@ -157,6 +157,7 @@ Compose selections are unchanged.
 | --- | --- | --- |
 | Runner Debian 13.7 slim, reviewed 2026-11-05 | `sha256:f6b08b09a05725f9431502d3b5714f5c4576e82c1a84fa1debe0c24a7e0c3ec4` | Docker Hub index, Linux amd64/arm64 manifests and config bytes match their digests; base configs were created 2026-10-27. Registry metadata alone does not establish package compatibility or specific CVE fixes |
 | Runner Debian 13.7 slim, reviewed 2026-10-30 | `sha256:62bd423aeee912639ca8ee681c2b762cb3e25137e0a92b20be455898a9f034ad` | Docker Hub manifest bytes match the digest and include Linux amd64 and arm64; base configs were created 2026-10-20; retained historical review |
+| Controller Debian 13.7 slim, reviewed 2026-11-05 | `sha256:f6b08b09a05725f9431502d3b5714f5c4576e82c1a84fa1debe0c24a7e0c3ec4` | Docker Hub manifest bytes match the digest and include Linux amd64 and arm64; base configs were created 2026-10-27 |
 | Controller Debian 13.7 slim, reviewed 2026-10-30 | `sha256:62bd423aeee912639ca8ee681c2b762cb3e25137e0a92b20be455898a9f034ad` | Docker Hub manifest bytes match the digest and include Linux amd64 and arm64; base configs were created 2026-10-20 |
 | Debian 13.7 slim, reviewed 2026-10-12 for both images | `sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f` | Docker Hub registry manifest for `library/debian:13.7-slim`; retained historical review |
 | Go 1.27.3 Bookworm build image | `sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5` | Docker Hub registry manifest for `library/golang:1.27.3-bookworm`; [upstream patch notes](https://go.dev/doc/devel/release#go1.27.3) |