diff --git a/Dockerfile b/Dockerfile
index 460930e..8debe1e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,7 +5,7 @@
 #
 # The app is deliberately insecure. Publish the port on 127.0.0.1 only, as
 # above, and never run this image on a machine reachable from the internet.
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170
+FROM python:3.15-slim@sha256:65a65fc7b30b06cb6df4930fd4650697cb23f4c2698ab81fc87e4b031bc36928
 
 # ping is what /cmd and /cmd-subprocess run before the injected command.
 RUN apt-get update \