diff --git a/.grype/config.yaml b/.grype/config.yaml
new file mode 100644
index 0000000000..4a191445c6
--- /dev/null
+++ b/.grype/config.yaml
@@ -0,0 +1,6 @@
+ignore:
+  - vulnerability: CVE-2026-91403
+    package:
+      name: java-21-openjdk-headless
+      type: rpm
+    reason: "Remediated by RHSA-2026:88455 via ca-certificates; Grype still flags the OpenJDK RPM."
diff --git a/balena/manager.Dockerfile b/balena/manager.Dockerfile
index 16067937ea..b6d2e0aec7 100644
--- a/balena/manager.Dockerfile
+++ b/balena/manager.Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi10/openjdk-21-runtime:1.24-16
+FROM registry.access.redhat.com/ubi10/openjdk-21-runtime:1.24-17
 
 # Add git commit label must be specified at build time using --build-arg GIT_COMMIT=dadadadadad
 ARG GIT_COMMIT=unknown
@@ -90,3 +90,6 @@ RUN chmod +x /entrypoint.sh
 COPY heapdump-rename.sh /heapdump-rename.sh
 RUN chmod +x /heapdump-rename.sh
 ENTRYPOINT ["/entrypoint.sh"]
+
+# Update CA certificates to address CVE-2026-114406 until the base image includes the fix
+RUN microdnf upgrade -y ca-certificates && microdnf clean all
diff --git a/manager/Dockerfile b/manager/Dockerfile
index 7abc3ac88f..077ff4d4fb 100644
--- a/manager/Dockerfile
+++ b/manager/Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi10/openjdk-21-runtime:1.24-16
+FROM registry.access.redhat.com/ubi10/openjdk-21-runtime:1.24-17
 
 # Add git commit label must be specified at build time using --build-arg GIT_COMMIT=dadadadadad
 ARG GIT_COMMIT=unknown
@@ -188,3 +188,6 @@ RUN chmod +x /entrypoint.sh
 COPY heapdump-rename.sh /heapdump-rename.sh
 RUN chmod +x /heapdump-rename.sh
 ENTRYPOINT ["/entrypoint.sh"]
+
+# Update CA certificates to address CVE-2026-114406 until the base image includes the fix
+RUN microdnf upgrade -y ca-certificates && microdnf clean all