diff --git a/Dockerfile b/Dockerfile
index d8581ece4..d8804633b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,8 +19,8 @@ ARG CHARON_TOOLCHAIN_IMAGE=ghcr.io/wikid82/charon-toolchain
 # NOT Renovate-tracked (a content-hash tag has no series to follow, N7) — the
 # toolchain-image.yml bot owns these two lines. DIGEST is the arch-independent
 # manifest-list (OCI index) digest, so one pin covers linux/amd64 + linux/arm64.
-ARG CHARON_TOOLCHAIN_TAG=caddy-crowdsec-ca89f6a1428729c6
-ARG CHARON_TOOLCHAIN_DIGEST=sha256:f7c7a1ca44b61401fb95dd0ec44b5216f220e86581229be42117fb7de3005837
+ARG CHARON_TOOLCHAIN_TAG=caddy-crowdsec-1489e0af35d8b10c
+ARG CHARON_TOOLCHAIN_DIGEST=sha256:ff8e9e9accdb2f150dcfdad790ec56331205dac5f6454ca51f2c70234e223152
 
 # Stage selector — default consumes the prebuilt toolchain image (no compile).
 # Fork PRs / bootstrap / offline builds pass