diff --git a/crates/orion-cli/Dockerfile b/crates/orion-cli/Dockerfile
index a0944d64..a8c57db0 100644
--- a/crates/orion-cli/Dockerfile
+++ b/crates/orion-cli/Dockerfile
@@ -7,7 +7,7 @@
 #
 # Digest-pinned to the same base images as the server Dockerfile so a rebuild
 # months from now resolves the same layers; dependabot bumps the tag+digest.
-FROM rust:1.98-slim@sha256:cc0448b41c3b7b7fea44f5dc50eacba729a56db365b65b7bd5e8a82d5b3db078 AS chef
+FROM rust:1.98-slim@sha256:17d1ba895198f9934c6314ec5346a0d5115372f3243390c3d731e242f35c2f27 AS chef
 RUN cargo install cargo-chef --locked
 WORKDIR /app