diff --git a/Dockerfile b/Dockerfile
index d8aaea5..8f25248 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -40,7 +40,7 @@
 
 # Base image pinned by digest so builds are reproducible. Override
 # BASE_IMAGE to rebuild on a newer base. hadolint ignore=DL3006
-ARG BASE_IMAGE="ubuntu:26.04@sha256:3131b4cc82a783df6c9df078f86e01819a13594b865c2cad47bd1bca2b7063bb"
+ARG BASE_IMAGE="ubuntu:26.04@sha256:da6fc2be547864451aa253836dd926da33623312df4a9a243e35dc877c378a78"
 ARG VERSION="dev"
 ARG COMMIT=""
 
diff --git a/Dockerfile.test-client b/Dockerfile.test-client
index 2660531..92d4c52 100644
--- a/Dockerfile.test-client
+++ b/Dockerfile.test-client
@@ -17,7 +17,7 @@
 # Base image: Override with --build-arg UBUNTU_VERSION=xx.xx
 # Default: the same 26.04 LTS digest the server image pins.
 
-ARG UBUNTU_VERSION=26.04@sha256:3131b4cc82a783df6c9df078f86e01819a13594b865c2cad47bd1bca2b7063bb
+ARG UBUNTU_VERSION=26.04@sha256:da6fc2be547864451aa253836dd926da33623312df4a9a243e35dc877c378a78
 FROM ubuntu:${UBUNTU_VERSION}
 
 LABEL maintainer="HyperI <opensource@hyperi.io>"
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 0d34e9a..cf691b4 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -297,7 +297,7 @@ services:
     # Using maintained fork (pinned): https://github.com/nickfedor/watchtower
     # SECURITY: mounting docker.sock hands this container root-equivalent
     # control of the HOST - keep this profile opt-in and the tag pinned.
-    image: nickfedor/watchtower:1.20.3
+    image: nickfedor/watchtower:1.22.2
     container_name: watchtower
     restart: unless-stopped
     profiles: