diff --git a/charts/recruit/values.yaml b/charts/recruit/values.yaml
index 9a8a92998..8deb64654 100644
--- a/charts/recruit/values.yaml
+++ b/charts/recruit/values.yaml
@@ -30,7 +30,7 @@ waitForPostgresInitContainer:
   image: # +doc-gen:ignore
     registry: docker.io
     repository: library/postgres
-    tag: 18.0@sha256:1ffc019dae94eca6b09a49ca67d37398951346de3c3d0cfe23d8d4ca33da83fb
+    tag: 18.0@sha256:41fc5342eefba6cc2ccda736aaf034bbbb7c3df0fdb81516eba1ba33f360162c
     pullPolicy: IfNotPresent
 
 # container security context applied to init containers used by the query, list, and notify modules.
diff --git a/docker-compose/docker-compose.staging.yaml b/docker-compose/docker-compose.staging.yaml
index 9a55906d7..418b01ae5 100644
--- a/docker-compose/docker-compose.staging.yaml
+++ b/docker-compose/docker-compose.staging.yaml
@@ -140,7 +140,7 @@ services:
       - "traefik.http.routers.fhir.entrypoints=web"
 
   fhir-db:
-    image: docker.io/library/postgres:18.0@sha256:1ffc019dae94eca6b09a49ca67d37398951346de3c3d0cfe23d8d4ca33da83fb
+    image: docker.io/library/postgres:18.0@sha256:41fc5342eefba6cc2ccda736aaf034bbbb7c3df0fdb81516eba1ba33f360162c
     restart: unless-stopped
     deploy:
       resources:
diff --git a/src/Dockerfile b/src/Dockerfile
index 74d8a55ab..821a27242 100644
--- a/src/Dockerfile
+++ b/src/Dockerfile
@@ -17,7 +17,7 @@ gradle ":${MODULE_NAME}:test"
 gradle jacocoTestReport
 EOF
 
-FROM gcr.io/distroless/java21-debian12:nonroot@sha256:5d281651dbf431f0fa9bc28bce5514a5594d66ccd2f9bf8602adccfc2518d4f9
+FROM gcr.io/distroless/java21-debian12:nonroot@sha256:2491db610eb845917845285aa7bac120aa8a16d85435d03c8452d5ab24c1bf79
 WORKDIR /app
 
 ARG MODULE_NAME=query
diff --git a/src/hack/compose.yaml b/src/hack/compose.yaml
index 4f42f5341..cef7e1deb 100644
--- a/src/hack/compose.yaml
+++ b/src/hack/compose.yaml
@@ -69,7 +69,7 @@ services:
       - "traefik.http.routers.fhir.entrypoints=web"
 
   fhir-db:
-    image: docker.io/library/postgres:18.0@sha256:1ffc019dae94eca6b09a49ca67d37398951346de3c3d0cfe23d8d4ca33da83fb
+    image: docker.io/library/postgres:18.0@sha256:41fc5342eefba6cc2ccda736aaf034bbbb7c3df0fdb81516eba1ba33f360162c
     restart: unless-stopped
     deploy:
       resources:
@@ -339,7 +339,7 @@ services:
       - "traefik.http.routers.maildev.entrypoints=web"
 
   notify-ha-db:
-    image: docker.io/library/postgres:18.0@sha256:1ffc019dae94eca6b09a49ca67d37398951346de3c3d0cfe23d8d4ca33da83fb
+    image: docker.io/library/postgres:18.0@sha256:41fc5342eefba6cc2ccda736aaf034bbbb7c3df0fdb81516eba1ba33f360162c
     restart: unless-stopped
     deploy:
       resources:
@@ -619,7 +619,7 @@ services:
         condition: service_started
 
   metastore-db:
-    image: docker.io/library/postgres:18.0@sha256:1ffc019dae94eca6b09a49ca67d37398951346de3c3d0cfe23d8d4ca33da83fb
+    image: docker.io/library/postgres:18.0@sha256:41fc5342eefba6cc2ccda736aaf034bbbb7c3df0fdb81516eba1ba33f360162c
     profiles:
       - trino
     ipc: private
diff --git a/src/list/Dockerfile b/src/list/Dockerfile
index 8b0da3d98..857641382 100644
--- a/src/list/Dockerfile
+++ b/src/list/Dockerfile
@@ -26,7 +26,7 @@ COPY server/package.json ./server/
 RUN npm clean-install --workspace=server
 COPY server/*.js ./server/
 
-FROM gcr.io/distroless/nodejs22-debian12:nonroot@sha256:1014312994b734e9f3bba23bb96fab389119750a98f14bc76936dc2a7e72c3da
+FROM gcr.io/distroless/nodejs22-debian12:nonroot@sha256:9187fd451b5e2d258d691cb7da51020bfc8f557cc4a58e80b38f3f30bbbc37f9
 WORKDIR /app
 USER 65532:65532
 # Port 8081 is currently not used, but exposed to make
diff --git a/src/notify/tests/e2e/docker-compose.yaml b/src/notify/tests/e2e/docker-compose.yaml
index fc7e9bde3..efd972a30 100644
--- a/src/notify/tests/e2e/docker-compose.yaml
+++ b/src/notify/tests/e2e/docker-compose.yaml
@@ -24,7 +24,7 @@ services:
       - maildev
 
   jobstore-db:
-    image: docker.io/library/postgres:18.0@sha256:1ffc019dae94eca6b09a49ca67d37398951346de3c3d0cfe23d8d4ca33da83fb
+    image: docker.io/library/postgres:18.0@sha256:41fc5342eefba6cc2ccda736aaf034bbbb7c3df0fdb81516eba1ba33f360162c
     environment:
       # kics-scan ignore-line
       POSTGRES_PASSWORD: postgres # pragma: allowlist secret