diff --git a/backup/Dockerfile b/backup/Dockerfile
index 4f0a5f7..ce97fde 100644
--- a/backup/Dockerfile
+++ b/backup/Dockerfile
@@ -1,6 +1,6 @@
 # PulseBase backup sidecar: pg_dump (PG16) + age encryption + optional rclone offsite.
 # Connects to the db service over the internal network (no docker socket, no extra privilege).
-FROM postgres:18-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873
+FROM postgres:18-alpine@sha256:10a5c69a83035ab5239f5620d708520e8b28f5aa1f2b20143e6024532edadfb5
 
 # age   = backup encryption (X25519 / ChaCha20-Poly1305), Alpine community
 # rclone = optional offsite copy (3-2-1 rule)