diff --git a/sandbox/.devcontainer/Dockerfile b/sandbox/.devcontainer/Dockerfile
index dfb458a..a91577f 100644
--- a/sandbox/.devcontainer/Dockerfile
+++ b/sandbox/.devcontainer/Dockerfile
@@ -1,6 +1,6 @@
 # Generic universal full-dev sandbox image — devcontainer-FREE (built by `container build`).
 # Root entrypoint configures the firewall and proxy, then drops privileges.
-FROM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251
+FROM debian:bookworm-slim@sha256:7c7b2c966bc9ee8cedfeef67e0e279108992c77681fa595db4a9d65c06ccc587
 
 ARG TZ=UTC
 ENV TZ="$TZ"