diff --git a/sops/container.go b/sops/container.go
index 1b5dfcc7..c53cc05e 100644
--- a/sops/container.go
+++ b/sops/container.go
@@ -29,7 +29,7 @@ var ageSHA256 = map[string]string{
 // are used from it, but "latest" alone changes underneath every run. Renovate
 // moves the digest.
 // renovate: datasource=docker depName=cgr.dev/chainguard/wolfi-base
-const baseImageTag = "latest@sha256:238642d42c5613936474d00b900c4e65fb6f637d8991c913403ff09a09cf43a3"
+const baseImageTag = "latest@sha256:81211e15a86ea1d5357f284482af45730c51de45eaf10ad9ce205d6bfc2df323"
 
 const defaultBaseImage = "cgr.dev/chainguard/wolfi-base:" + baseImageTag