diff --git a/Dockerfile b/Dockerfile
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 #syntax=docker/dockerfile:1
-FROM ghcr.io/denoland/deno:debian-2.7.14 AS builder
+FROM ghcr.io/denoland/deno:debian-2.8.1@sha256:ddaad47cbbbbd856d73bd0d50074a0e308c51671d83442eebb15f1039dd4a822 AS builder
 
 WORKDIR /app
 
@@ -13,7 +13,7 @@
 RUN --mount=type=cache,target=/deno-dir/ \
     deno task build
 
-FROM ghcr.io/denoland/deno:distroless-2.7.14
+FROM ghcr.io/denoland/deno:distroless-2.8.1@sha256:2005d7c2aed55c198dcf97df5a3d4d1926a87a80b5bb8b5175a607b18b319f7b
 
 WORKDIR /app
 COPY --from=builder /app/_fresh/ ./
diff --git a/flake.lock b/flake.lock
--- a/flake.lock
+++ b/flake.lock
@@ -20,11 +20,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1779414690,
-        "narHash": "sha256-gOTcX/9MZVMUE0Xvb4IEcv+0TQJkZFNEnL757ljU360=",
+        "lastModified": 1779877693,
+        "narHash": "sha256-NOF9NAREhxr50bbBfVcVOq+ArCMSoe8dP79Pk2uyARk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "6dedf69f94d03cbe7bdde106f2d4c23ae2a853bf",
+        "rev": "4100e830e085863741bc69b156ec4ccd53ab5be0",
         "type": "github"
       },
       "original": {