diff --git a/crates/registry-relay/Dockerfile b/crates/registry-relay/Dockerfile
index 27c51e772..4a103ddf5 100644
--- a/crates/registry-relay/Dockerfile
+++ b/crates/registry-relay/Dockerfile
@@ -3,7 +3,7 @@
 ARG REGISTRY_RELAY_FEATURES="attribute-release,crosswalk-runtime"
 
 # Keep the tag for humans and the digest for reproducible pulls.
-FROM rust:1.95-trixie@sha256:f49565f188ee00bc2a18dd418183f2c5f23ef7d6e691890517ed341a598f67c3 AS builder
+FROM rust:1.97-trixie@sha256:1bcff4befb740599103a2c7cb51058e14479b2e35e3a34a3f0dc4ede09927488 AS builder
 ARG REGISTRY_RELAY_FEATURES
 WORKDIR /workspace/registry_relay
 
diff --git a/crates/registry-relay/Dockerfile.demo b/crates/registry-relay/Dockerfile.demo
index e0e7ad9b0..9f2f7c062 100644
--- a/crates/registry-relay/Dockerfile.demo
+++ b/crates/registry-relay/Dockerfile.demo
@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1.7
 
 # Keep the tag for humans and the digest for reproducible pulls.
-FROM rust:1.95-trixie@sha256:f49565f188ee00bc2a18dd418183f2c5f23ef7d6e691890517ed341a598f67c3 AS builder
+FROM rust:1.97-trixie@sha256:1bcff4befb740599103a2c7cb51058e14479b2e35e3a34a3f0dc4ede09927488 AS builder
 WORKDIR /workspace/registry_relay
 
 COPY Cargo.toml Cargo.lock ./
diff --git a/products/notary/Dockerfile b/products/notary/Dockerfile
index ce66e484d..5eb68c8e0 100644
--- a/products/notary/Dockerfile
+++ b/products/notary/Dockerfile
@@ -3,7 +3,7 @@
 # syntax=docker/dockerfile:1.7
 
 # Keep the tag for humans and the digest for reproducible pulls.
-FROM rust:1.95-trixie@sha256:f49565f188ee00bc2a18dd418183f2c5f23ef7d6e691890517ed341a598f67c3 AS builder
+FROM rust:1.97-trixie@sha256:1bcff4befb740599103a2c7cb51058e14479b2e35e3a34a3f0dc4ede09927488 AS builder
 
 WORKDIR /workspace/registry-notary
 COPY --from=registry-platform Cargo.toml README.md LICENSE /workspace/registry-platform/
diff --git a/release/conformance/openid/nginx.Dockerfile b/release/conformance/openid/nginx.Dockerfile
index fe87e108a..0f75a50b9 100644
--- a/release/conformance/openid/nginx.Dockerfile
+++ b/release/conformance/openid/nginx.Dockerfile
@@ -1,4 +1,4 @@
-FROM nginx:1.27.3@sha256:bc2f6a7c8ddbccf55bdb19659ce3b0a92ca6559e86d42677a5a02ef6bda2fcef
+FROM nginx:1.31.3@sha256:5a88c9c45479443d7be2eadc894b4ed0a9801bae03d97a5760ae13b5c2005942
 
 RUN openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
         -keyout /etc/ssl/private/nginx-selfsigned.key \
diff --git a/release/conformance/openid/server-dev.Dockerfile b/release/conformance/openid/server-dev.Dockerfile
index 6f2de45ee..5a6726ac4 100644
--- a/release/conformance/openid/server-dev.Dockerfile
+++ b/release/conformance/openid/server-dev.Dockerfile
@@ -1,5 +1,5 @@
 # Mirrors the pinned suite's development server image while fixing its base.
-FROM eclipse-temurin:21@sha256:da9d3a4f7650db39b918fc5a2c3da76556fb8cc8e5f3767cdea0bb409286951a
+FROM eclipse-temurin:25@sha256:201fbb8886b2d273218aa3a192f0afbf7b5ff65ee8cc6ef47f5dce2171f013ea
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends redir=3.3-1build1 \