diff --git a/Dockerfile b/Dockerfile
index 0fec95b95a..8d229dba56 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -318,7 +318,7 @@ COPY --from=nsjail /nsjail/nsjail /bin/nsjail
 
 # crane: pulls + flattens images for the sandboxed container runtime (`# sandbox <image>`).
 # Single static binary — no daemon/store/root needed. See docs/docker-v2-runtime.md.
-ARG CRANE_VERSION=v0.21.7
+ARG CRANE_VERSION=v0.22.1
 RUN arch="$(dpkg --print-architecture)"; \
     case "$arch" in amd64) crane_arch=x86_64 ;; arm64) crane_arch=arm64 ;; *) echo >&2 "error: unsupported arch '$arch' for crane"; exit 1 ;; esac; \
     wget -O /tmp/crane.tgz "https://github.com/google/go-containerregistry/releases/download/${CRANE_VERSION}/go-containerregistry_Linux_${crane_arch}.tar.gz" \
diff --git a/docker/DockerfileSlim b/docker/DockerfileSlim
index 6418a2cfda..45986bbd5f 100644
--- a/docker/DockerfileSlim
+++ b/docker/DockerfileSlim
@@ -96,7 +96,7 @@ COPY --from=nsjail /nsjail/nsjail /bin/nsjail
 
 # crane: pulls + flattens images for the sandboxed container runtime (`# sandbox <image>`).
 # Single static binary — no daemon/store/root needed. See docs/docker-v2-runtime.md.
-ARG CRANE_VERSION=v0.21.7
+ARG CRANE_VERSION=v0.22.1
 RUN arch="$(dpkg --print-architecture)"; \
     case "$arch" in amd64) crane_arch=x86_64 ;; arm64) crane_arch=arm64 ;; *) echo >&2 "error: unsupported arch '$arch' for crane"; exit 1 ;; esac; \
     wget -O /tmp/crane.tgz "https://github.com/google/go-containerregistry/releases/download/${CRANE_VERSION}/go-containerregistry_Linux_${crane_arch}.tar.gz" \
diff --git a/docker/DockerfileSlimEe b/docker/DockerfileSlimEe
index 24ef941b87..5ac24f5c1d 100644
--- a/docker/DockerfileSlimEe
+++ b/docker/DockerfileSlimEe
@@ -96,7 +96,7 @@ COPY --from=nsjail /nsjail/nsjail /bin/nsjail
 
 # crane: pulls + flattens images for the sandboxed container runtime (`# sandbox <image>`).
 # Single static binary — no daemon/store/root needed. See docs/docker-v2-runtime.md.
-ARG CRANE_VERSION=v0.21.7
+ARG CRANE_VERSION=v0.22.1
 RUN arch="$(dpkg --print-architecture)"; \
     case "$arch" in amd64) crane_arch=x86_64 ;; arm64) crane_arch=arm64 ;; *) echo >&2 "error: unsupported arch '$arch' for crane"; exit 1 ;; esac; \
     wget -O /tmp/crane.tgz "https://github.com/google/go-containerregistry/releases/download/${CRANE_VERSION}/go-containerregistry_Linux_${crane_arch}.tar.gz" \