diff --git a/sops/container.go b/sops/container.go
index 1b5dfcc7..68709ba8 100644
--- a/sops/container.go
+++ b/sops/container.go
@@ -29,7 +29,7 @@ var ageSHA256 = map[string]string{
 // are used from it, but "latest" alone changes underneath every run. Renovate
 // moves the digest.
 // renovate: datasource=docker depName=cgr.dev/chainguard/wolfi-base
-const baseImageTag = "latest@sha256:238642d42c5613936474d00b900c4e65fb6f637d8991c913403ff09a09cf43a3"
+const baseImageTag = "latest@sha256:0b179206ab162b12a43bacea1b525a4023e0272005c92d08555c61b1beaedc40"
 
 const defaultBaseImage = "cgr.dev/chainguard/wolfi-base:" + baseImageTag