diff --git a/packaging/Dockerfile b/packaging/Dockerfile
index b7e25ce..f4a7574 100644
--- a/packaging/Dockerfile
+++ b/packaging/Dockerfile
@@ -7,7 +7,7 @@
 # and it does NOT run ClamAV on-access (fanotify) protection. Optional container
 # monitoring reads the Docker API through the separate GET-only proxy image
 # (packaging/Dockerfile.proxy, docker-compose.container.yml).
-FROM python:3.12-slim-bookworm
+FROM python:3.15-slim-bookworm
 
 # Build-time Debian mirror override, e.g.
 #   docker compose build --build-arg DEBIAN_MIRROR=http://mirrors.ustc.edu.cn
diff --git a/packaging/Dockerfile.proxy b/packaging/Dockerfile.proxy
index c4a8961..e1ffa10 100644
--- a/packaging/Dockerfile.proxy
+++ b/packaging/Dockerfile.proxy
@@ -2,7 +2,7 @@
 #
 # A deliberately tiny image. It receives the Docker socket and exposes only an
 # allowlisted GET API to lsec over an internal-only network.
-FROM python:3.12-slim-bookworm
+FROM python:3.15-slim-bookworm
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \