diff --git a/crates/fakecloud-rds/assets/mariadb/Dockerfile b/crates/fakecloud-rds/assets/mariadb/Dockerfile
index 2d0d68b1..ece2c0f8 100644
--- a/crates/fakecloud-rds/assets/mariadb/Dockerfile
+++ b/crates/fakecloud-rds/assets/mariadb/Dockerfile
@@ -26,6 +26,7 @@ RUN chmod 0755 /usr/local/bin/gosu
 # symmetric with the mysql Dockerfile means a single source of truth
 # for the build rule.
 RUN apt-get update \
+    && apt-get upgrade -y --no-install-recommends \
     && apt-get install -y --no-install-recommends \
         gcc make libcurl4-openssl-dev libc6-dev ca-certificates curl \
     && rm -rf /var/lib/apt/lists/*
diff --git a/crates/fakecloud-rds/assets/mysql/Dockerfile b/crates/fakecloud-rds/assets/mysql/Dockerfile
index 3ff17e12..87d8fa6e 100644
--- a/crates/fakecloud-rds/assets/mysql/Dockerfile
+++ b/crates/fakecloud-rds/assets/mysql/Dockerfile
@@ -52,6 +52,7 @@ RUN set -eux; \
         microdnf clean all; \
     elif command -v apt-get >/dev/null 2>&1; then \
         apt-get update; \
+        apt-get upgrade -y --no-install-recommends; \
         apt-get install -y --no-install-recommends \
             gcc make libcurl4-openssl-dev libc6-dev ca-certificates; \
         rm -rf /var/lib/apt/lists/*; \
diff --git a/crates/fakecloud-rds/assets/postgres/Dockerfile b/crates/fakecloud-rds/assets/postgres/Dockerfile
index bf9286dd..8be82a81 100644
--- a/crates/fakecloud-rds/assets/postgres/Dockerfile
+++ b/crates/fakecloud-rds/assets/postgres/Dockerfile
@@ -24,7 +24,13 @@ ARG PG_VERSION
 COPY --from=gosu-builder /go/bin/gosu /usr/local/bin/gosu
 RUN chmod 0755 /usr/local/bin/gosu
 
+# `apt-get upgrade` pulls in patched OS packages (openssl, glibc, dirmngr…)
+# which sometimes lag behind on the upstream `postgres:<major>` tag —
+# Trivy flags those as HIGH/CRITICAL even when fixes are available in
+# the same Debian release. Running upgrade keeps the published image
+# clean against the latest debian13 security DB at build time.
 RUN apt-get update \
+    && apt-get upgrade -y --no-install-recommends \
     && apt-get install -y --no-install-recommends \
         postgresql-plpython3-${PG_VERSION} \
         ca-certificates \