diff --git a/Dockerfile b/Dockerfile
index 93862fe0b9..7d53a5a58a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -169,8 +169,12 @@ ENV UV_TOOL_DIR=/usr/local/uv
 
 ENV PATH /usr/local/bin:/root/.local/bin:/tmp/.local/bin:$PATH
 
-
-RUN apt-get update \
+# The build cache keeps the apt layer while the base image digest and this line are unchanged, so
+# Debian security updates are not picked up by later builds. Bump to force a fresh apt-get upgrade;
+# bump it in docker/DockerfileSlim and docker/DockerfileSlimEe too.
+ARG APT_REFRESH=1
+RUN echo "apt refresh ${APT_REFRESH}" \
+    && apt-get update \
     && apt-get upgrade -y \
     && apt-get install -y --no-install-recommends netbase tzdata ca-certificates wget curl jq unzip build-essential unixodbc xmlsec1 tini gnupg libargon2-1 \
     && if echo "$features" | grep -q "ee"; then apt-get install -y --no-install-recommends libsasl2-modules-gssapi-mit krb5-user; fi \
diff --git a/docker/DockerfileSlim b/docker/DockerfileSlim
index 0a1e5a0c42..daeb64b637 100644
--- a/docker/DockerfileSlim
+++ b/docker/DockerfileSlim
@@ -44,7 +44,10 @@ ENV UV_TOOL_DIR=/usr/local/uv
 ENV PATH=/usr/local/bin:/root/.local/bin:/tmp/.local/bin:$PATH
 
 # Install system dependencies
-RUN apt-get update \
+# Bump to force a fresh apt-get upgrade past the build cache; keep in step with ../Dockerfile.
+ARG APT_REFRESH=1
+RUN echo "apt refresh ${APT_REFRESH}" \
+    && apt-get update \
     && apt-get upgrade -y \
     && apt-get install -y --no-install-recommends ca-certificates wget curl git jq unzip unixodbc xmlsec1 gnupg lsb-release libgnutls30t64 libgcrypt20 \
     && apt-get clean \
diff --git a/docker/DockerfileSlimEe b/docker/DockerfileSlimEe
index 46d0d2d98f..3edff33038 100644
--- a/docker/DockerfileSlimEe
+++ b/docker/DockerfileSlimEe
@@ -44,7 +44,10 @@ ENV UV_TOOL_DIR=/usr/local/uv
 ENV PATH=/usr/local/bin:/root/.local/bin:/tmp/.local/bin:$PATH
 
 # Install system dependencies
-RUN apt-get update \
+# Bump to force a fresh apt-get upgrade past the build cache; keep in step with ../Dockerfile.
+ARG APT_REFRESH=1
+RUN echo "apt refresh ${APT_REFRESH}" \
+    && apt-get update \
     && apt-get upgrade -y \
     && apt-get install -y --no-install-recommends ca-certificates wget curl git jq unzip unixodbc xmlsec1 gnupg lsb-release libgnutls30t64 libgcrypt20 \
     && apt-get clean \