diff --git a/Dockerfile.base b/Dockerfile.base
index 5dc3605a9..4047aa4ac 100644
--- a/Dockerfile.base
+++ b/Dockerfile.base
@@ -1,5 +1,5 @@
 FROM --platform=linux/amd64 \
-    ruby:2.7.6-alpine3.16@sha256:b014cf3e792d7130daec772241a211c40be009fc7f00e2b728ffe26805649575
+    ruby:3.4-slim-trixie@sha256:a1e521f7710a59431695c0628de8ffdbbceec17065a217bd67b59343d4d17b22
 
 # This is the base Docker image for scip-ruby with common dependencies
 
@@ -10,19 +10,18 @@ ARG SCIP_RUBY_VERSION
 RUN test -n "${SCIP_RUBY_VERSION}" || \
     (echo "ERROR: SCIP_RUBY_VERSION build arg is required" && exit 1)
 
-# gcompat is a glibc-musl compat library (scip-ruby links in glibc)
-# Other deps are to help build C extensions in gems.
-RUN apk add --no-cache \
-    bash \
-    wget \
-    make \
-    libstdc++ \
-    gcc \
-    g++ \
-    automake \
-    autoconf \
-    gcompat \
-    git
+# ca-certificates is listed so the build picks up trust store fixes from
+# trixie-security (e.g. 20250419+deb13u1 distrusts the compromised eMudhra chains).
+# The other deps are used by the autoindex script and to build C extensions in gems.
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        wget \
+        git \
+        build-essential \
+        automake \
+        autoconf && \
+    rm -rf /var/lib/apt/lists/*
 
 # Use a release binary instead of building from source
 # because release builds are very time-consuming.
@@ -31,9 +30,13 @@ RUN apk add --no-cache \
 # The binary at this version is guaranteed to exist because this workflow runs either:
 # 1. Manually with a specific tag that already has a release
 # 2. After the Release workflow completes (which creates the release and uploads the binary)
+#
+# `scip-ruby --version` fails the build if the binary can't run on this base
+# (e.g. it needs a newer glibc).
 RUN wget https://github.com/sourcegraph/scip-ruby/releases/download/scip-ruby-v${SCIP_RUBY_VERSION}/scip-ruby-x86_64-linux \
     -O /usr/bin/scip-ruby && \
-    chmod +x /usr/bin/scip-ruby
+    chmod +x /usr/bin/scip-ruby && \
+    scip-ruby --version
 
 # Set working directory for sources
 WORKDIR /sources