diff --git a/Dockerfile b/Dockerfile
index 8dac7c1..717730a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -64,9 +64,9 @@ FROM build-base AS unbound
 
 WORKDIR /src
 
-ARG UNBOUND_VERSION=1.24.0
-# https://nlnetlabs.nl/downloads/unbound/unbound-1.24.0.tar.gz.sha256
-ARG UNBOUND_SHA256="147b22983cc7008aa21007e251b3845bfcf899ffd2d3b269253ebf2e27465086"
+ARG UNBOUND_VERSION=1.24.1
+# https://nlnetlabs.nl/downloads/unbound/unbound-1.24.1.tar.gz.sha256
+ARG UNBOUND_SHA256="7f2b1633e239409619ae0527f67878b0f33ae0ec0ee5a3a51c042c359ba1eeab"
 
 ADD https://nlnetlabs.nl/downloads/unbound/unbound-${UNBOUND_VERSION}.tar.gz unbound.tar.gz
 
diff --git a/rootfs_overlay/etc/unbound/unbound.conf.example b/rootfs_overlay/etc/unbound/unbound.conf.example
index dc9e623..56bb324 100644
--- a/rootfs_overlay/etc/unbound/unbound.conf.example
+++ b/rootfs_overlay/etc/unbound/unbound.conf.example
@@ -1,7 +1,7 @@
 #
 # Example configuration file.
 #
-# See unbound.conf(5) man page, version 1.24.0.
+# See unbound.conf(5) man page, version 1.24.1.
 #
 # this is a comment.
 
@@ -196,6 +196,10 @@ server:
 	# Limit on upstream queries for an incoming query and its recursion.
 	# max-global-quota: 200
 
+	# Should the scrubber remove promiscuous NS from positive answers,
+	# protects against poison attempts.
+	# iter-scrub-promiscuous: yes
+
 	# msec for waiting for an unknown server to reply.  Increase if you
 	# are behind a slow satellite link, to eg. 1128.
 	# unknown-server-time-limit: 376