diff --git a/Dockerfile b/Dockerfile
index b71094aef..77560ac32 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,8 +19,8 @@ ARG CHARON_TOOLCHAIN_IMAGE=ghcr.io/wikid82/charon-toolchain
 # NOT Renovate-tracked (a content-hash tag has no series to follow, N7) — the
 # toolchain-image.yml bot owns these two lines. DIGEST is the arch-independent
 # manifest-list (OCI index) digest, so one pin covers linux/amd64 + linux/arm64.
-ARG CHARON_TOOLCHAIN_TAG=caddy-crowdsec-96036cc6d410b06f
-ARG CHARON_TOOLCHAIN_DIGEST=sha256:28729c5a3ffec9cee9c05eff727ee17cd1e6a78bb73d1a9a83eafbb3e6f981ec
+ARG CHARON_TOOLCHAIN_TAG=caddy-crowdsec-7c346dc645bf6f48
+ARG CHARON_TOOLCHAIN_DIGEST=sha256:a4f05519b7d48bce981e2a6aeee4f13c0b7368623069b5b8f403da0c5ff5bb14
 
 # Stage selector — default consumes the prebuilt toolchain image (no compile).
 # Fork PRs / bootstrap / offline builds pass