diff --git a/docker/Dockerfile.e2e b/docker/Dockerfile.e2e
index 8e3d680..f523fdd 100644
--- a/docker/Dockerfile.e2e
+++ b/docker/Dockerfile.e2e
@@ -26,7 +26,7 @@ RUN cargo build --release --features pam \
     && make install DESTDIR=/install PREFIX=/usr
 
 # ── Stage 2: runtime with tests ────────────────────────────────────
-FROM debian:trixie
+FROM debian:trixie-20260421
 
 # Install GNU shadow-utils first — this creates /etc/pam.d/passwd,
 # /etc/pam.d/su, and other PAM configs we need. We overwrite the