diff --git a/.github/actions/docker-run/action.yaml b/.github/actions/docker-run/action.yaml
index 5b6e113cd4..6c6a2fdbf5 100644
--- a/.github/actions/docker-run/action.yaml
+++ b/.github/actions/docker-run/action.yaml
@@ -6,7 +6,7 @@ inputs:
     required: true
   image:
     description: "The image to use"
-    default: "ghcr.io/wolfi-dev/sdk:latest@sha256:aea64123d532f1d215763a8064cc087bc2ff2c99af65c7b3210f599454bdf257"
+    default: "ghcr.io/wolfi-dev/sdk:latest@sha256:7adf273490b664cd997b204c99f04638a26e8fab31f53bad68474062fd4c589f"
     required: false
   workdir:
     description: "The images working directory"
diff --git a/.github/workflows/build-beta.yaml b/.github/workflows/build-beta.yaml
index 5881b2584f..c02f6e1761 100644
--- a/.github/workflows/build-beta.yaml
+++ b/.github/workflows/build-beta.yaml
@@ -152,7 +152,7 @@ jobs:
 
     container:
       # NOTE: This step only signs and uploads, so it doesn't need any privileges
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:aea64123d532f1d215763a8064cc087bc2ff2c99af65c7b3210f599454bdf257
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:7adf273490b664cd997b204c99f04638a26e8fab31f53bad68474062fd4c589f
 
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/build-old.yaml b/.github/workflows/build-old.yaml
index 64d7caeb97..cd080ebe52 100644
--- a/.github/workflows/build-old.yaml
+++ b/.github/workflows/build-old.yaml
@@ -26,7 +26,7 @@ jobs:
       contents: read
 
     container:
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:aea64123d532f1d215763a8064cc087bc2ff2c99af65c7b3210f599454bdf257
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:7adf273490b664cd997b204c99f04638a26e8fab31f53bad68474062fd4c589f
       # TODO: Deprivilege
       options: |
         --cap-add NET_ADMIN --cap-add SYS_ADMIN --device /dev/fuse --security-opt seccomp=unconfined --security-opt apparmor:unconfined
@@ -139,7 +139,7 @@ jobs:
 
     container:
       # NOTE: This step only signs and uploads, so it doesn't need any privileges
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:aea64123d532f1d215763a8064cc087bc2ff2c99af65c7b3210f599454bdf257
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:7adf273490b664cd997b204c99f04638a26e8fab31f53bad68474062fd4c589f
 
     steps:
       - name: Harden Runner
@@ -262,7 +262,7 @@ jobs:
 
     container:
       # NOTE: This step only signs and uploads, so it doesn't need any privileges
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:aea64123d532f1d215763a8064cc087bc2ff2c99af65c7b3210f599454bdf257
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:7adf273490b664cd997b204c99f04638a26e8fab31f53bad68474062fd4c589f
 
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/build-world.yaml b/.github/workflows/build-world.yaml
index 8152d8e96c..97449153fd 100644
--- a/.github/workflows/build-world.yaml
+++ b/.github/workflows/build-world.yaml
@@ -27,7 +27,7 @@ jobs:
     # permissions:
 
     container:
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:aea64123d532f1d215763a8064cc087bc2ff2c99af65c7b3210f599454bdf257
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:7adf273490b664cd997b204c99f04638a26e8fab31f53bad68474062fd4c589f
       # TODO: Deprivilege
       options: |
         --cap-add NET_ADMIN --cap-add SYS_ADMIN --device /dev/fuse --security-opt seccomp=unconfined --security-opt apparmor:unconfined
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index b4f710b794..9caed44c06 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -29,7 +29,7 @@ jobs:
       contents: read
 
     container:
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:aea64123d532f1d215763a8064cc087bc2ff2c99af65c7b3210f599454bdf257
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:7adf273490b664cd997b204c99f04638a26e8fab31f53bad68474062fd4c589f
       # TODO: Deprivilege
       options: |
         --cap-add NET_ADMIN --cap-add SYS_ADMIN --device /dev/fuse --security-opt seccomp=unconfined --security-opt apparmor:unconfined
@@ -175,7 +175,7 @@ jobs:
 
     container:
       # NOTE: This step only signs and uploads, so it doesn't need any privileges
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:aea64123d532f1d215763a8064cc087bc2ff2c99af65c7b3210f599454bdf257
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:7adf273490b664cd997b204c99f04638a26e8fab31f53bad68474062fd4c589f
 
     steps:
       - name: Harden Runner
@@ -303,7 +303,7 @@ jobs:
 
     container:
       # NOTE: This step only signs and uploads, so it doesn't need any privileges
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:aea64123d532f1d215763a8064cc087bc2ff2c99af65c7b3210f599454bdf257
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:7adf273490b664cd997b204c99f04638a26e8fab31f53bad68474062fd4c589f
 
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/lint-world.yaml b/.github/workflows/lint-world.yaml
index 4831e9d8e6..d50e1687db 100644
--- a/.github/workflows/lint-world.yaml
+++ b/.github/workflows/lint-world.yaml
@@ -32,7 +32,7 @@ jobs:
       group: wolfi-os-builder-${{ matrix.arch }}
 
     container:
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:aea64123d532f1d215763a8064cc087bc2ff2c99af65c7b3210f599454bdf257
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:7adf273490b664cd997b204c99f04638a26e8fab31f53bad68474062fd4c589f
 
     steps:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
diff --git a/.github/workflows/postsubmit-bundle-build.yaml b/.github/workflows/postsubmit-bundle-build.yaml
index e7c48122c5..9fad853601 100644
--- a/.github/workflows/postsubmit-bundle-build.yaml
+++ b/.github/workflows/postsubmit-bundle-build.yaml
@@ -30,7 +30,7 @@ jobs:
 
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:aea64123d532f1d215763a8064cc087bc2ff2c99af65c7b3210f599454bdf257
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:7adf273490b664cd997b204c99f04638a26e8fab31f53bad68474062fd4c589f
 
     permissions:
       id-token: write
@@ -114,7 +114,7 @@ jobs:
           )
 
           BUNDLE=$(wolfictl bundle \
-            --bundle-base ghcr.io/wolfi-dev/sdk:latest@sha256:aea64123d532f1d215763a8064cc087bc2ff2c99af65c7b3210f599454bdf257 \
+            --bundle-base ghcr.io/wolfi-dev/sdk:latest@sha256:7adf273490b664cd997b204c99f04638a26e8fab31f53bad68474062fd4c589f \
             --bundle-repo "${BUNDLE_REPO}" \
             ${COMMON_FLAGS} \
             --runner bubblewrap \
diff --git a/Makefile b/Makefile
index d53a08be39..3d95832519 100644
--- a/Makefile
+++ b/Makefile
@@ -141,7 +141,7 @@ dev-container:
 	    -v "${PWD}:${PWD}" \
 	    -w "${PWD}" \
 	    -e SOURCE_DATE_EPOCH=0 \
-	    ghcr.io/wolfi-dev/sdk:latest@sha256:aea64123d532f1d215763a8064cc087bc2ff2c99af65c7b3210f599454bdf257
+	    ghcr.io/wolfi-dev/sdk:latest@sha256:7adf273490b664cd997b204c99f04638a26e8fab31f53bad68474062fd4c589f
 
 PACKAGES_CONTAINER_FOLDER ?= /work/packages
 # This target spins up a docker container that is helpful for testing local
@@ -208,6 +208,6 @@ dev-container-wolfi:
 		--mount type=bind,source="${PWD}/local-melange.rsa.pub",destination="/etc/apk/keys/local-melange.rsa.pub",readonly \
 		--mount type=bind,source="$(TMP_REPOS_FILE)",destination="/etc/apk/repositories",readonly \
 		-w "$(PACKAGES_CONTAINER_FOLDER)" \
-		ghcr.io/wolfi-dev/sdk:latest@sha256:aea64123d532f1d215763a8064cc087bc2ff2c99af65c7b3210f599454bdf257
+		ghcr.io/wolfi-dev/sdk:latest@sha256:7adf273490b664cd997b204c99f04638a26e8fab31f53bad68474062fd4c589f
 	@rm "$(TMP_REPOS_FILE)"
 	@rmdir "$(TMP_REPOS_DIR)"