diff --git a/images/cassandra/Dockerfile b/images/cassandra/Dockerfile
index 62c8477..699131a 100644
--- a/images/cassandra/Dockerfile
+++ b/images/cassandra/Dockerfile
@@ -45,10 +45,12 @@ ENV DEBIAN_FRONTEND=noninteractive
 RUN set -eux; \
     apt-get update; \
     apt-get install -y --no-install-recommends ca-certificates curl procps xz-utils zstd; \
-    # The base digest predates Debian's pcre2 and expat security updates. They
-    # are fixable, so they are fixed -- named packages only, so nothing else in
-    # the pinned base moves.
-    apt-get install -y --only-upgrade libpcre2-8-0 libexpat1; \
+    # The base digest predates Debian's pcre2, expat and perl-base security
+    # updates. They are fixable, so they are fixed -- named packages only, so
+    # nothing else in the pinned base moves. perl-base is the only perl package
+    # the bookworm-based 4.1 image carries (fixed in 5.36.0-7+deb12u4); on a
+    # base where a named package is absent, --only-upgrade skips it.
+    apt-get install -y --only-upgrade libpcre2-8-0 libexpat1 perl-base; \
     rm -rf /var/lib/apt/lists/*
 
 # gosu from the gotools stage (DESIGN.md D-51). gosu replaces
diff --git a/images/pg/Dockerfile b/images/pg/Dockerfile
index ad027f7..e2e8f5f 100644
--- a/images/pg/Dockerfile
+++ b/images/pg/Dockerfile
@@ -154,10 +154,14 @@ ENV DEBIAN_FRONTEND=noninteractive \
 # during step 1 research (DESIGN.md section 4).
 RUN set -eux; \
     apt-get update; \
-    # The base digest predates Debian's pcre2 and expat security updates. They
-    # are fixable, so they are fixed -- named packages only, so the PostgreSQL
-    # server the digest pins does not move.
-    apt-get install -y --only-upgrade libpcre2-8-0 libexpat1; \
+    # The base digest predates Debian's pcre2, expat and perl security updates.
+    # They are fixable, so they are fixed -- named packages only, so the
+    # PostgreSQL server the digest pins does not move. The four perl packages
+    # move together: perl depends on the exact perl-base version, so upgrading
+    # one alone does not resolve. pgvector has not rebuilt 0.8.6 since
+    # 2026-08-13, so there is no newer digest to repin to (perl 5.36.0-7+deb12u4).
+    apt-get install -y --only-upgrade libpcre2-8-0 libexpat1 \
+        perl perl-base perl-modules-5.36 libperl5.36; \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \