diff --git a/docker-compose.yml b/docker-compose.yml
index 3cd7f1c..9d0d2ae 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -9,7 +9,7 @@ services:
   # only inside this short-lived sidecar that exits before any workflow runs),
   # a compromised PR can never read it. See mint-runner-token.sh for details.
   roku-runner-registrar:
-    image: alpine:latest@sha256:a2d49ea686c2adfe3c992e47dc3b5e7fa6e6b5055609400dc2acaeb241c829f4
+    image: alpine:latest@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
     container_name: roku-runner-registrar
     environment:
       - TZ=${TIMEZONE:-America/New_York}
@@ -110,7 +110,7 @@ services:
         max-file: "3"
 
   iptables-sidecar:
-    image: alpine:latest@sha256:a2d49ea686c2adfe3c992e47dc3b5e7fa6e6b5055609400dc2acaeb241c829f4
+    image: alpine:latest@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
     container_name: roku-iptables
     cap_add:
       - NET_ADMIN