diff --git a/versions.lock.json b/versions.lock.json
index 9af1275..aa6f476 100644
--- a/versions.lock.json
+++ b/versions.lock.json
@@ -7,7 +7,7 @@
         "overrides": {
           "github.com/go-jose/go-jose/v4": "v4.1.6",
           "github.com/klauspost/compress": "v1.20.2",
-          "golang.org/x/crypto": "v0.58.1-0.20261009181718-2f1f834330b2",
+          "golang.org/x/crypto": "v0.59.0",
           "golang.org/x/net": "v0.62.0"
         }
       }
@@ -24,7 +24,7 @@
       "4.15.1": {
         "module": "github.com/tofuutils/tenv/v4",
         "overrides": {
-          "golang.org/x/crypto": "v0.58.1-0.20261009181718-2f1f834330b2",
+          "golang.org/x/crypto": "v0.59.0",
           "golang.org/x/mod": "v0.40.0",
           "golang.org/x/net": "v0.62.0",
           "golang.org/x/sys": "v0.44.0",
@@ -36,7 +36,7 @@
       "0.24.0": {
         "module": "github.com/terraform-docs/terraform-docs",
         "overrides": {
-          "golang.org/x/crypto": "v0.58.1-0.20261009181718-2f1f834330b2",
+          "golang.org/x/crypto": "v0.59.0",
           "golang.org/x/mod": "v0.40.0",
           "golang.org/x/net": "v0.62.0",
           "golang.org/x/sys": "v0.44.0",
@@ -50,7 +50,7 @@
         "module": "github.com/terraform-linters/tflint",
         "overrides": {
           "github.com/go-jose/go-jose/v4": "v4.1.6",
-          "golang.org/x/crypto": "v0.58.1-0.20261009181718-2f1f834330b2",
+          "golang.org/x/crypto": "v0.59.0",
           "golang.org/x/net": "v0.62.0"
         }
       }
diff --git a/versions.yml b/versions.yml
index 09ab11b..c0fe697 100644
--- a/versions.yml
+++ b/versions.yml
@@ -50,21 +50,21 @@ platforms:
 # change to this block alone. Keep each value a bare reference: `just pin`
 # rewrites it.
 bases:
-  alpine: dhi.io/alpine-base:3.24-alpine3.24-dev@sha256:52a1dd05ab0348e71cf244d595d9ce59268c68ac3fdd6338c18997fe035b36a7
-  debian: dhi.io/debian-base:trixie-debian13-dev@sha256:61025cea33d5910165ced8b33edd3f6b6bfe161e129174887936a1b9a1442b20
-  python-3.12: dhi.io/python:3.12-debian13-dev@sha256:a211f0321f6b95709f447f5bf9a88c7d92ee42c71f40ad07741e3865ae6d23bc
-  python-3.13: dhi.io/python:3.13-debian13-dev@sha256:1303a6c6e9b856cfe9e1b25eaf44b4a165c28a8402140ef3b5151d9a60e4033a
-  python-3.14: dhi.io/python:3.14-debian13-dev@sha256:9ac7d2837dbd5739f0657be0b4af1cf9c6d0cc582a5d5886da9d4b321a03b8c3
-  python-3.15: dhi.io/python:3.15-debian13-dev@sha256:f9121e954baf4ec5f29d85f5025b64b4274054607db9753ac090a42281c66a7d
+  alpine: dhi.io/alpine-base:3.24-alpine3.24-dev@sha256:266554e75cb00f88effe4048ba78b6f628d6a5ca67ac9e9727ae37a4a1299ce5
+  debian: dhi.io/debian-base:trixie-debian13-dev@sha256:94571f3dc07fbc7166f6f1cbf1fe068a7647198ee2554e6b90d59a68cc8b053c
+  python-3.12: dhi.io/python:3.12-debian13-dev@sha256:c7090b12d1050252ee964efa9190124c3053a8679bfd7fa33aff9d5123fb673c
+  python-3.13: dhi.io/python:3.13-debian13-dev@sha256:cc070c5f483069c53e251a63d114f1f17af806f257a67c9106967247d3ee092a
+  python-3.14: dhi.io/python:3.14-debian13-dev@sha256:d43af3feac6200c6d6ebd2000d8833779bd69260bb91d9035aaaa0b0635f705f
+  python-3.15: dhi.io/python:3.15-debian13-dev@sha256:57d020a69247e1e3c63e640d1df57633b8ea444498dccda306349c0debbabdc8
 
 # Other bases that every pull request builds and smoke tests the latest
 # version of each image on, so that changing distribution stays a one-line
 # edit. Nothing built on these is published.
 portability:
-  alpine: dhi.io/alpine-base:3.24-alpine3.24-dev@sha256:52a1dd05ab0348e71cf244d595d9ce59268c68ac3fdd6338c18997fe035b36a7
+  alpine: dhi.io/alpine-base:3.24-alpine3.24-dev@sha256:266554e75cb00f88effe4048ba78b6f628d6a5ca67ac9e9727ae37a4a1299ce5
   rhel: registry.access.redhat.com/ubi10/ubi:10.1@sha256:15f0a6e2b448ac7aa24425c9ab541e6402dc32b782844a285ccaeffb1c938fe1
-  rhel-minimal: registry.access.redhat.com/ubi10/ubi-minimal:10.2@sha256:c3fe95ec9f53a3888c47314eb4d08bde09ebde646a428137b445091afe1daf89
-  wolfi: cgr.dev/chainguard/wolfi-base:latest@sha256:24f549a7fcace88e69b9557941168c74645688ecc4acf7fb6d734a6b74e9019d
+  rhel-minimal: registry.access.redhat.com/ubi10/ubi-minimal:10.2@sha256:f0c7b9ae9914fcf183e7c36fc46864903c2d2caf3af327421913ae54b3d29e94
+  wolfi: cgr.dev/chainguard/wolfi-base:latest@sha256:94fa13e26d449f7d78dbcd02d12ea37a0da80d24fcc3e1f17b95d515dec607a7
 
 # Tools, by exact version. The Go tools (shfmt, tenv, TFLint, terraform-docs,
 # Conftest) are built from source with this Go, never downloaded as binaries,