diff --git a/sops/container.go b/sops/container.go
index 1b5dfcc7..6de92670 100644
--- a/sops/container.go
+++ b/sops/container.go
@@ -29,7 +29,7 @@ var ageSHA256 = map[string]string{
 // are used from it, but "latest" alone changes underneath every run. Renovate
 // moves the digest.
 // renovate: datasource=docker depName=cgr.dev/chainguard/wolfi-base
-const baseImageTag = "latest@sha256:238642d42c5613936474d00b900c4e65fb6f637d8991c913403ff09a09cf43a3"
+const baseImageTag = "latest@sha256:256c88bb066424045021090932d50be93c8e3f2ce3586707702a401b146f3e43"
 
 const defaultBaseImage = "cgr.dev/chainguard/wolfi-base:" + baseImageTag