diff --git a/Dockerfile b/Dockerfile
index bc2be9f8..aea42a74 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # Copyright 2020 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.15.2 as build-env
+FROM golang:1.15.3 as build-env
 
 WORKDIR /work
 # Get dependencies first so they can be cached as a layer
@@ -24,7 +24,7 @@ RUN mkdir out \
   && CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o out ./cmd/local-user-authenticator/...
 
 # Use a runtime image based on Debian slim
-FROM debian:10.5-slim
+FROM debian:10.6-slim
 
 # Copy the binaries from the build-env stage
 COPY --from=build-env /work/out/pinniped-concierge /usr/local/bin/pinniped-concierge
diff --git a/hack/lib/tilt/Tiltfile b/hack/lib/tilt/Tiltfile
index 899b5ada..767582c8 100644
--- a/hack/lib/tilt/Tiltfile
+++ b/hack/lib/tilt/Tiltfile
@@ -140,7 +140,7 @@ k8s_yaml(local([
     '--data-value namespace=concierge ' +
     '--data-value image_repo=image/concierge ' +
     '--data-value image_tag=tilt-dev ' +
-    '--data-value kube_cert_agent_image=debian:10.5-slim ' +
+    '--data-value kube_cert_agent_image=debian:10.6-slim ' +
     '--data-value discovery_url=$(TERM=dumb kubectl cluster-info | awk \'/Kubernetes master/ {print $NF}\') ' +
     '--data-value-yaml replicas=1 ' +
     '--data-value-yaml "custom_labels={myConciergeCustomLabelName: myConciergeCustomLabelValue}"'
diff --git a/hack/lib/tilt/concierge.Dockerfile b/hack/lib/tilt/concierge.Dockerfile
index ea4d5959..4ff460fa 100644
--- a/hack/lib/tilt/concierge.Dockerfile
+++ b/hack/lib/tilt/concierge.Dockerfile
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # Use a runtime image based on Debian slim
-FROM debian:10.5-slim
+FROM debian:10.6-slim
 
 # Copy the binary which was built outside the container.
 COPY build/pinniped-concierge /usr/local/bin/pinniped-concierge
diff --git a/hack/lib/tilt/local-user-authenticator.Dockerfile b/hack/lib/tilt/local-user-authenticator.Dockerfile
index 0dd1523c..548328fa 100644
--- a/hack/lib/tilt/local-user-authenticator.Dockerfile
+++ b/hack/lib/tilt/local-user-authenticator.Dockerfile
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # Use a runtime image based on Debian slim
-FROM debian:10.5-slim
+FROM debian:10.6-slim
 
 # Copy the binary which was built outside the container.
 COPY build/local-user-authenticator /usr/local/bin/local-user-authenticator
diff --git a/hack/lib/tilt/supervisor.Dockerfile b/hack/lib/tilt/supervisor.Dockerfile
index a62772e1..a9d7a369 100644
--- a/hack/lib/tilt/supervisor.Dockerfile
+++ b/hack/lib/tilt/supervisor.Dockerfile
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # Use a runtime image based on Debian slim
-FROM debian:10.5-slim
+FROM debian:10.6-slim
 
 # Copy the binary which was built outside the container.
 COPY build/pinniped-supervisor /usr/local/bin/pinniped-supervisor