diff --git a/tests/e2e/fixtures/cabundle-kaniko/Dockerfile b/tests/e2e/fixtures/cabundle-kaniko/Dockerfile
index 92bf54d..86fb486 100644
--- a/tests/e2e/fixtures/cabundle-kaniko/Dockerfile
+++ b/tests/e2e/fixtures/cabundle-kaniko/Dockerfile
@@ -11,7 +11,7 @@
 # CertificateAudit accepts the alternative location only when the copy carries
 # the digest the ca-certificates stamp file at /etc/ssl/certs records, which an
 # untouched copy does. The rule must therefore PASS.
-FROM cgr.dev/chainguard/wolfi-base:latest@sha256:07e60ff6586b56f03c625e27b604f9f7d29498fef32f099f6560f0d207b4a056
+FROM cgr.dev/chainguard/wolfi-base:latest@sha256:0a8fd427de5882aed77471b0a432c3675eda6b6a0ae952b5d640b46da628cdbe
 
 # Suppress OrbStack's automatic root-CA injection so the bundle (and the copy
 # taken from it) is identical to the upstream wolfi-base bundle the stamp file