diff --git a/Dockerfile b/Dockerfile
index e1d45cbc..fff1130b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,7 +9,7 @@
 # =============================================================================
 # Stage 1: Go builder
 # =============================================================================
-FROM golang:1.26-bookworm@sha256:116d58cbd88c1297624acc6e967a060012422bacf9930927e23fb719189c6f36 AS builder
+FROM golang:1.27-bookworm@sha256:648f440f42a0958804efb24df176f806f9d353b41f1c0627f666428e40310f6b AS builder
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     git ca-certificates && \
@@ -50,7 +50,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build \
 # =============================================================================
 # Stage 2: Runtime (single image, all backends)
 # =============================================================================
-FROM debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241
+FROM debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171
 
 # Runtime deps. docker.io/netcat for the docker backend + healthcheck; python3 +
 # librsvg + fonts are the lean provisioning floor for the *direct* backend (the
diff --git a/Dockerfile.mcp b/Dockerfile.mcp
index 05fe93de..3c8a41bc 100644
--- a/Dockerfile.mcp
+++ b/Dockerfile.mcp
@@ -2,7 +2,7 @@
 # Build: docker build -f Dockerfile.mcp -t ethpandaops-panda-server .
 
 # Build stage
-FROM golang:1.26-alpine AS builder
+FROM golang:1.27-alpine AS builder
 
 WORKDIR /app
 
diff --git a/Dockerfile.proxy b/Dockerfile.proxy
index efd74ba7..8ea3985b 100644
--- a/Dockerfile.proxy
+++ b/Dockerfile.proxy
@@ -2,7 +2,7 @@
 # Build: docker build -f Dockerfile.proxy -t ethpandaops-panda-proxy .
 
 # Build stage
-FROM golang:1.26-alpine AS builder
+FROM golang:1.27-alpine AS builder
 
 WORKDIR /app
 
diff --git a/sandbox/Dockerfile b/sandbox/Dockerfile
index f75c8229..d574fe04 100644
--- a/sandbox/Dockerfile
+++ b/sandbox/Dockerfile
@@ -9,7 +9,7 @@
 # hard error rather than an unlocked source compile, and no C toolchain is
 # needed in either stage.
 
-FROM python:3.11-slim@sha256:a3ab0b966bc4e91546a033e22093cb840908979487a9fc0e6e38295747e49ac0 AS builder
+FROM python:3.11-slim@sha256:9534e5a8e315485d4061ed659af0fd78a284c015f9b73661b41d6bab25604534 AS builder
 
 # uv (build-time only; never copied into the final image)
 COPY --from=ghcr.io/astral-sh/uv:0.11.17@sha256:03bdc89bb9798628846e60c3a9ad19006c8c3c724ccd2985a33145c039a0577b /uv /uvx /bin/
@@ -37,7 +37,7 @@ COPY modules/*/python/*.py /opt/ethpandaops-pkg/ethpandaops/
 # so no toolchain is required to build it.
 RUN uv pip install --python /usr/local/bin/python3 --prefix /install --no-cache --no-deps /opt/ethpandaops-pkg
 
-FROM python:3.11-slim@sha256:a3ab0b966bc4e91546a033e22093cb840908979487a9fc0e6e38295747e49ac0
+FROM python:3.11-slim@sha256:9534e5a8e315485d4061ed659af0fd78a284c015f9b73661b41d6bab25604534
 
 # librsvg provides rsvg-convert, which the chartkit library uses to rasterise its
 # self-contained SVG charts. The chart font (Inter) is embedded as a data URI; the extra