diff --git a/.github/workflows/update-docker-args.yml b/.github/workflows/update-docker-args.yml
index d4f9a10..e3bccb5 100644
--- a/.github/workflows/update-docker-args.yml
+++ b/.github/workflows/update-docker-args.yml
@@ -17,7 +17,7 @@ jobs:
         shell: bash
         id: args
         run: |
-          BASE_IMAGE="gcr.io/distroless/cc-debian12"
+          BASE_IMAGE="gcr.io/distroless/cc-debian13"
           BASE_IMAGE_TAG="debug"
           BASE_IMAGE_DIGEST=$(gcloud container images list-tags $BASE_IMAGE --format json | jq --arg tag "$BASE_IMAGE_TAG" -r '.[] | {digest: .digest, tag: .tags[]} | select(.tag == $tag) | .digest')
           if [ -n "$BASE_IMAGE_DIGEST" ]; then
diff --git a/java-11/Dockerfile b/java-11/Dockerfile
index e42d35f..ea67a4a 100644
--- a/java-11/Dockerfile
+++ b/java-11/Dockerfile
@@ -5,7 +5,7 @@ ARG BASE_IMAGE
 # Zulu CA build straight from Azul's CDN. The SHA-256 pins the download. jlink copies blocked.certs
 # from the JDK it runs, so it must be the fixed one.
 # TEMP: go back to azul/zulu-openjdk-debian once it publishes a tag with the fix.
-FROM debian:bookworm-slim AS jre
+FROM debian:trixie-slim AS jre
 ARG JAVA_VERSION
 ARG TARGETARCH
 # Update these together with java.version.
@@ -73,9 +73,9 @@ jdk.zipfs\
 RUN grep -q 7BA62FEC54E9D040556FCA70A6A88F03761C178FA1F7CB8390A73076849F55A2 /jre/lib/security/blocked.certs
 
 # Extract java SSL certs
-FROM gcr.io/distroless/java-base-debian12:debug AS ssl
+FROM gcr.io/distroless/java-base-debian13:debug AS ssl
 
-FROM debian:bookworm-slim As builder
+FROM debian:trixie-slim AS builder
 RUN apt update && apt install -y libjemalloc-dev
 
 # stage for amd64
@@ -84,8 +84,8 @@ FROM ${BASE_IMAGE} AS base-amd64
 SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
 
-COPY --from=jre /lib/x86_64-linux-gnu/libz.so.1.2.13 /lib/x86_64-linux-gnu/libz.so.1.2.13
-RUN ln -s /lib/x86_64-linux-gnu/libz.so.1.2.13 /lib/x86_64-linux-gnu/libz.so.1
+# libz.so.1 is already present in the base image
+RUN test -e /lib/x86_64-linux-gnu/libz.so.1
 
 # change default memory allocator to jemalloc
 COPY --from=builder /usr/lib/x86_64-linux-gnu/libjemalloc* /usr/lib/x86_64-linux-gnu/
@@ -97,8 +97,8 @@ FROM ${BASE_IMAGE} AS base-arm64
 SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
 
-COPY --from=jre /lib/aarch64-linux-gnu/libz.so.1.2.13 /lib/aarch64-linux-gnu/libz.so.1.2.13
-RUN ln -s /lib/aarch64-linux-gnu/libz.so.1.2.13 /lib/aarch64-linux-gnu/libz.so.1
+# libz.so.1 is already present in the base image
+RUN test -e /lib/aarch64-linux-gnu/libz.so.1
 
 # change default memory allocator to jemalloc
 COPY --from=builder /usr/lib/aarch64-linux-gnu/libjemalloc* /usr/lib/aarch64-linux-gnu/
diff --git a/java-11/base.image b/java-11/base.image
index 4828d2b..1c126e2 100644
--- a/java-11/base.image
+++ b/java-11/base.image
@@ -1 +1 @@
-gcr.io/distroless/cc-debian12:debug@sha256:bc3546a529388660b583cc85ca6559927652d54391dc8059419d7b4bf3921154
+gcr.io/distroless/cc-debian13:debug@sha256:8eb229dfe1ec97410a495e312dfba214afd86bfc72010973e08796ac5e94e234
diff --git a/java-21/Dockerfile b/java-21/Dockerfile
index 309a4e2..a25269d 100644
--- a/java-21/Dockerfile
+++ b/java-21/Dockerfile
@@ -5,7 +5,7 @@ ARG BASE_IMAGE
 # Zulu CA build straight from Azul's CDN. The SHA-256 pins the download. jlink copies blocked.certs
 # from the JDK it runs, so it must be the fixed one.
 # TEMP: go back to azul/zulu-openjdk-debian once it publishes a tag with the fix.
-FROM debian:bookworm-slim AS jre
+FROM debian:trixie-slim AS jre
 ARG JAVA_VERSION
 ARG TARGETARCH
 # Update these together with java.version.
@@ -73,9 +73,9 @@ jdk.zipfs\
 RUN grep -q 7BA62FEC54E9D040556FCA70A6A88F03761C178FA1F7CB8390A73076849F55A2 /jre/lib/security/blocked.certs
 
 # Extract java SSL certs
-FROM gcr.io/distroless/java-base-debian12:debug AS ssl
+FROM gcr.io/distroless/java-base-debian13:debug AS ssl
 
-FROM debian:bookworm-slim AS builder
+FROM debian:trixie-slim AS builder
 RUN apt update && apt install -y libjemalloc-dev
 
 # stage for amd64
@@ -84,8 +84,8 @@ FROM ${BASE_IMAGE} AS base-amd64
 SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
 
-COPY --from=jre /lib/x86_64-linux-gnu/libz.so.1.2.13 /lib/x86_64-linux-gnu/libz.so.1.2.13
-RUN ln -s /lib/x86_64-linux-gnu/libz.so.1.2.13 /lib/x86_64-linux-gnu/libz.so.1
+# libz.so.1 is already present in the base image
+RUN test -e /lib/x86_64-linux-gnu/libz.so.1
 
 # change default memory allocator to jemalloc
 COPY --from=builder /usr/lib/x86_64-linux-gnu/libjemalloc* /usr/lib/x86_64-linux-gnu/
@@ -97,8 +97,8 @@ FROM ${BASE_IMAGE} AS base-arm64
 SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
 
-COPY --from=jre /lib/aarch64-linux-gnu/libz.so.1.2.13 /lib/aarch64-linux-gnu/libz.so.1.2.13
-RUN ln -s /lib/aarch64-linux-gnu/libz.so.1.2.13 /lib/aarch64-linux-gnu/libz.so.1
+# libz.so.1 is already present in the base image
+RUN test -e /lib/aarch64-linux-gnu/libz.so.1
 
 # change default memory allocator to jemalloc
 COPY --from=builder /usr/lib/aarch64-linux-gnu/libjemalloc* /usr/lib/aarch64-linux-gnu/
diff --git a/java-21/base.image b/java-21/base.image
index 4828d2b..1c126e2 100644
--- a/java-21/base.image
+++ b/java-21/base.image
@@ -1 +1 @@
-gcr.io/distroless/cc-debian12:debug@sha256:bc3546a529388660b583cc85ca6559927652d54391dc8059419d7b4bf3921154
+gcr.io/distroless/cc-debian13:debug@sha256:8eb229dfe1ec97410a495e312dfba214afd86bfc72010973e08796ac5e94e234