diff --git a/action.yml b/action.yml
index 0a0f0b2..c944d09 100644
--- a/action.yml
+++ b/action.yml
@@ -30,7 +30,7 @@ runs:
   # By digest, pinned at bootstrap and moved by a reviewed commit. A tag here
   # would let whoever can push to `ci` run code in every pipeline in the
   # cluster, holding that pipeline's deploy credential.
-  image: docker://git.512.dev/ci/toolbox@sha256:a891c4f9458f8ddc2ebf8cfd1c659cc29d321f1688cd0e3d7b1fa40dffa5582f
+  image: docker://git.512.dev/ci/toolbox@sha256:3cf48d3adf5f67483290242bfd66e46b4b9b003d0ced847f5617161353b0986d
 
   entrypoint: /usr/local/lib/actions/deploy-app.sh
   env: