diff --git a/Dockerfile b/Dockerfile
index e2fd438..02e1368 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,7 +6,7 @@
 # pointer somebody else moves: two builds of the same commit can differ, which makes a reproducible
 # build a coincidence. The digest is the manifest list, so buildx still picks amd64 or arm64 by
 # itself. Dependabot proposes the bump; a human takes it.
-FROM python:3.12-slim@sha256:646fb0bca3dd3ea1bcc6feb72c17ed16eed6e10cffc732fcc1478bd3e7f02d7b AS build
+FROM python:3.14-slim@sha256:ce40764625a4ff50df3548277632e7f96c4e77fe75fa848aae9885476e7df5a4 AS build
 
 ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
     PIP_NO_CACHE_DIR=1
@@ -23,7 +23,7 @@ RUN python -m venv /opt/venv \
     && /opt/venv/bin/pip install ".${EXTRAS}"
 
 # --- runtime: no build tools, no source tree, no root ------------------------
-FROM python:3.12-slim@sha256:646fb0bca3dd3ea1bcc6feb72c17ed16eed6e10cffc732fcc1478bd3e7f02d7b AS runtime
+FROM python:3.14-slim@sha256:ce40764625a4ff50df3548277632e7f96c4e77fe75fa848aae9885476e7df5a4 AS runtime
 
 ENV PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1 \