diff --git a/app/artifact-cas/Dockerfile.goreleaser b/app/artifact-cas/Dockerfile.goreleaser
index 65655e438..53cc72f49 100644
--- a/app/artifact-cas/Dockerfile.goreleaser
+++ b/app/artifact-cas/Dockerfile.goreleaser
@@ -1,5 +1,11 @@
 FROM golang:1.27.3@sha256:957861185dbf29d93668ace41e011d091c6e779953d47f0316ef2cc58e28fe2b AS builder
 
+# Refresh the Debian CA bundle in the builder so the trust store copied into the
+# scratch image reflects the latest distrust list, rather than the (frozen) bundle
+# shipped in the pinned builder digest.
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
 FROM scratch
 
 COPY ./artifact-cas /
diff --git a/app/cli/Dockerfile.goreleaser b/app/cli/Dockerfile.goreleaser
index 61c4607bc..2c3db0ce6 100644
--- a/app/cli/Dockerfile.goreleaser
+++ b/app/cli/Dockerfile.goreleaser
@@ -1,5 +1,10 @@
 FROM golang:1.27.3@sha256:957861185dbf29d93668ace41e011d091c6e779953d47f0316ef2cc58e28fe2b AS builder
-RUN mkdir -p /.config/chainloop /rootfs/tmp && chmod 1777 /rootfs/tmp
+# Refresh the Debian CA bundle in the builder so the trust store copied into the
+# scratch image reflects the latest distrust list, rather than the (frozen) bundle
+# shipped in the pinned builder digest.
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir -p /.config/chainloop /rootfs/tmp && chmod 1777 /rootfs/tmp
 
 FROM scratch
 
diff --git a/app/controlplane/Dockerfile.goreleaser b/app/controlplane/Dockerfile.goreleaser
index cce2ad173..6f9446082 100644
--- a/app/controlplane/Dockerfile.goreleaser
+++ b/app/controlplane/Dockerfile.goreleaser
@@ -1,5 +1,11 @@
 FROM golang:1.27.3@sha256:957861185dbf29d93668ace41e011d091c6e779953d47f0316ef2cc58e28fe2b AS builder
 
+# Refresh the Debian CA bundle in the builder so the trust store copied into the
+# scratch image reflects the latest distrust list, rather than the (frozen) bundle
+# shipped in the pinned builder digest.
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
 FROM scratch
 
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/