diff --git a/Dockerfile b/Dockerfile
index 73c50799..fdec5b50 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -25,7 +25,7 @@ RUN mkdir out \
   && CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o out ./cmd/local-user-authenticator/...
 
 # Use a runtime image based on Debian slim
-FROM debian:10.6-slim
+FROM debian:10.7-slim
 RUN apt-get update && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/*
 
 # Copy the binaries from the build-env stage
diff --git a/hack/lib/tilt/Tiltfile b/hack/lib/tilt/Tiltfile
index 6bd2e479..8233f665 100644
--- a/hack/lib/tilt/Tiltfile
+++ b/hack/lib/tilt/Tiltfile
@@ -148,7 +148,7 @@ k8s_yaml(local([
     '--data-value namespace=concierge ' +
     '--data-value image_repo=image/concierge ' +
     '--data-value image_tag=tilt-dev ' +
-    '--data-value kube_cert_agent_image=debian:10.6-slim ' +
+    '--data-value kube_cert_agent_image=debian:10.7-slim ' +
     '--data-value discovery_url=$(TERM=dumb kubectl cluster-info | awk \'/master|control plane/ {print $NF}\') ' +
     '--data-value log_level=debug ' +
     '--data-value-yaml replicas=1 ' +
diff --git a/hack/lib/tilt/concierge.Dockerfile b/hack/lib/tilt/concierge.Dockerfile
index c2927bdf..e9daadd6 100644
--- a/hack/lib/tilt/concierge.Dockerfile
+++ b/hack/lib/tilt/concierge.Dockerfile
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # Use a runtime image based on Debian slim
-FROM debian:10.6-slim
+FROM debian:10.7-slim
 
 # Copy the binary which was built outside the container.
 COPY build/pinniped-concierge /usr/local/bin/pinniped-concierge
diff --git a/hack/lib/tilt/local-user-authenticator.Dockerfile b/hack/lib/tilt/local-user-authenticator.Dockerfile
index b63a212a..6b8430f6 100644
--- a/hack/lib/tilt/local-user-authenticator.Dockerfile
+++ b/hack/lib/tilt/local-user-authenticator.Dockerfile
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # Use a runtime image based on Debian slim
-FROM debian:10.6-slim
+FROM debian:10.7-slim
 
 # Copy the binary which was built outside the container.
 COPY build/local-user-authenticator /usr/local/bin/local-user-authenticator
diff --git a/hack/lib/tilt/supervisor.Dockerfile b/hack/lib/tilt/supervisor.Dockerfile
index 468749ad..916d009a 100644
--- a/hack/lib/tilt/supervisor.Dockerfile
+++ b/hack/lib/tilt/supervisor.Dockerfile
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # Use a runtime image based on Debian slim
-FROM debian:10.6-slim
+FROM debian:10.7-slim
 
 RUN apt-get update && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/*
 
diff --git a/test/deploy/dex/proxy.yaml b/test/deploy/dex/proxy.yaml
index be4d4878..84b4307c 100644
--- a/test/deploy/dex/proxy.yaml
+++ b/test/deploy/dex/proxy.yaml
@@ -48,7 +48,7 @@ spec:
             periodSeconds: 5
             failureThreshold: 2
         - name: accesslogs
-          image: debian:10.6-slim
+          image: debian:10.7-slim
           command:
             - "/bin/sh"
             - "-c"