diff --git a/.github/workflows/build-world.yaml b/.github/workflows/build-world.yaml
index f3d3a02af48e..5dda213bf1fc 100644
--- a/.github/workflows/build-world.yaml
+++ b/.github/workflows/build-world.yaml
@@ -20,7 +20,7 @@ jobs:
       fail-fast: false
 
     container:
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:26f510522abb4923875e8424c611e41cdf5fd017117f1a88e234ec2f8da6a25c
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:30f10892576d3ec9579655cf2e6b39a147b998d48bbc9f09a83d1b8879e84093
       options: |
         --cap-add NET_ADMIN --cap-add SYS_ADMIN --security-opt seccomp=unconfined --security-opt apparmor:unconfined
 
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 67fec46eb079..aa412a1fb1c9 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -31,7 +31,7 @@ jobs:
     # permissions:
 
     container:
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:26f510522abb4923875e8424c611e41cdf5fd017117f1a88e234ec2f8da6a25c
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:30f10892576d3ec9579655cf2e6b39a147b998d48bbc9f09a83d1b8879e84093
       # TODO: Deprivilege
       options: |
         --cap-add NET_ADMIN --cap-add SYS_ADMIN --device /dev/fuse --security-opt seccomp=unconfined --security-opt apparmor:unconfined
@@ -104,7 +104,7 @@ jobs:
 
     container:
       # NOTE: This step only signs and uploads, so it doesn't need any privileges
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:26f510522abb4923875e8424c611e41cdf5fd017117f1a88e234ec2f8da6a25c
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:30f10892576d3ec9579655cf2e6b39a147b998d48bbc9f09a83d1b8879e84093
 
     steps:
       - uses: actions/checkout@v3
diff --git a/.github/workflows/ci-build.yaml b/.github/workflows/ci-build.yaml
index 9b752d4e2b3d..c2493abf983b 100644
--- a/.github/workflows/ci-build.yaml
+++ b/.github/workflows/ci-build.yaml
@@ -27,7 +27,7 @@ jobs:
         run: |
           # Copy wolfictl out of the wolfictl image and onto PATH
           TMP=$(mktemp -d)
-          docker run --rm -i -v $TMP:/out --entrypoint /bin/sh ghcr.io/wolfi-dev/sdk:latest@sha256:26f510522abb4923875e8424c611e41cdf5fd017117f1a88e234ec2f8da6a25c -c "cp /usr/bin/wolfictl /out"
+          docker run --rm -i -v $TMP:/out --entrypoint /bin/sh ghcr.io/wolfi-dev/sdk:latest@sha256:30f10892576d3ec9579655cf2e6b39a147b998d48bbc9f09a83d1b8879e84093 -c "cp /usr/bin/wolfictl /out"
           echo "$TMP" >> $GITHUB_PATH
 
       # Assuming that we have a list of changed files such as `foo.yaml` and `bar.yaml`, this
@@ -57,7 +57,7 @@ jobs:
       - ${{ matrix.arch }}
     needs: changes
     container:
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:26f510522abb4923875e8424c611e41cdf5fd017117f1a88e234ec2f8da6a25c
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:30f10892576d3ec9579655cf2e6b39a147b998d48bbc9f09a83d1b8879e84093
       options: |
         --cap-add NET_ADMIN --cap-add SYS_ADMIN --security-opt seccomp=unconfined --security-opt apparmor:unconfined
 
diff --git a/.github/workflows/dag-push-production.yaml b/.github/workflows/dag-push-production.yaml
index 2e354a5c0c40..e476934f5458 100644
--- a/.github/workflows/dag-push-production.yaml
+++ b/.github/workflows/dag-push-production.yaml
@@ -156,7 +156,7 @@ jobs:
             --cpu=30 --ram=100Gi \
             --bucket=${BUCKET} \
             --src-bucket=${SRC_BUCKET} \
-            --sdk-image ghcr.io/wolfi-dev/sdk:latest@sha256:26f510522abb4923875e8424c611e41cdf5fd017117f1a88e234ec2f8da6a25c \
+            --sdk-image ghcr.io/wolfi-dev/sdk:latest@sha256:30f10892576d3ec9579655cf2e6b39a147b998d48bbc9f09a83d1b8879e84093 \
             --pending-timeout=20m \
             --secret-key \
             --arch=arm64
diff --git a/.github/workflows/push-production.yaml b/.github/workflows/push-production.yaml
index c33897438e31..d3eb85035fb4 100644
--- a/.github/workflows/push-production.yaml
+++ b/.github/workflows/push-production.yaml
@@ -68,7 +68,7 @@ jobs:
         run: |
           # Copy wolfictl out of the wolfictl image and onto PATH
           TMP=$(mktemp -d)
-          docker run --rm -i -v $TMP:/out --entrypoint /bin/sh ghcr.io/wolfi-dev/sdk:latest@sha256:26f510522abb4923875e8424c611e41cdf5fd017117f1a88e234ec2f8da6a25c -c "cp /usr/bin/wolfictl /out"
+          docker run --rm -i -v $TMP:/out --entrypoint /bin/sh ghcr.io/wolfi-dev/sdk:latest@sha256:30f10892576d3ec9579655cf2e6b39a147b998d48bbc9f09a83d1b8879e84093 -c "cp /usr/bin/wolfictl /out"
           echo "$TMP" >> $GITHUB_PATH
 
       - name: 'Build Wolfi'
diff --git a/.github/workflows/wolfictl-check-update.yaml b/.github/workflows/wolfictl-check-update.yaml
index e92078d7b162..6d4437af3fee 100644
--- a/.github/workflows/wolfictl-check-update.yaml
+++ b/.github/workflows/wolfictl-check-update.yaml
@@ -28,7 +28,7 @@ jobs:
     - name: Check
       id: check
       if: ${{ steps.files.outputs.all_changed_files != '' }}
-      uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:3023aa69f01be4afcc82ca582af1196a4c8479c50f5f910080dd46a847e58dd8
+      uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:7cab6fb3a51e8c9a7085373247d2f0729784078279fb7b2ff1712a459118699a
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
diff --git a/.github/workflows/wolfictl-lint.yaml b/.github/workflows/wolfictl-lint.yaml
index 1b4b3731daa0..9bb2afb9e062 100644
--- a/.github/workflows/wolfictl-lint.yaml
+++ b/.github/workflows/wolfictl-lint.yaml
@@ -19,13 +19,13 @@ jobs:
     - uses: actions/checkout@v3
     - name: Lint
       id: lint
-      uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:3023aa69f01be4afcc82ca582af1196a4c8479c50f5f910080dd46a847e58dd8
+      uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:7cab6fb3a51e8c9a7085373247d2f0729784078279fb7b2ff1712a459118699a
       with:
         entrypoint: wolfictl
         args: lint --skip-rule no-makefile-entry-for-package
     - name: Enforce YAML formatting
       id: lint-yaml
-      uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:3023aa69f01be4afcc82ca582af1196a4c8479c50f5f910080dd46a847e58dd8
+      uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:7cab6fb3a51e8c9a7085373247d2f0729784078279fb7b2ff1712a459118699a
       with:
         entrypoint: wolfictl
         args: lint yam
diff --git a/.github/workflows/wolfictl-update-gh.yaml b/.github/workflows/wolfictl-update-gh.yaml
index 0c92eae66eb3..78da812b3e1f 100644
--- a/.github/workflows/wolfictl-update-gh.yaml
+++ b/.github/workflows/wolfictl-update-gh.yaml
@@ -23,7 +23,7 @@ jobs:
     steps:
     - uses: actions/checkout@v3
 
-    - uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:3023aa69f01be4afcc82ca582af1196a4c8479c50f5f910080dd46a847e58dd8
+    - uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:7cab6fb3a51e8c9a7085373247d2f0729784078279fb7b2ff1712a459118699a
       with:
         entrypoint: wolfictl
         args: update https://github.com/${{github.repository}} --release-monitoring-query=false --github-labels request-version-update --github-labels "automated pr"
diff --git a/.github/workflows/wolfictl-update-rm.yaml b/.github/workflows/wolfictl-update-rm.yaml
index ee539887e777..c799b868cccd 100644
--- a/.github/workflows/wolfictl-update-rm.yaml
+++ b/.github/workflows/wolfictl-update-rm.yaml
@@ -23,7 +23,7 @@ jobs:
     steps:
     - uses: actions/checkout@v3
 
-    - uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:3023aa69f01be4afcc82ca582af1196a4c8479c50f5f910080dd46a847e58dd8
+    - uses: docker://ghcr.io/wolfi-dev/wolfictl:latest@sha256:7cab6fb3a51e8c9a7085373247d2f0729784078279fb7b2ff1712a459118699a
       with:
         entrypoint: wolfictl
         args: update https://github.com/${{github.repository}} --github-release-query=false --github-labels request-version-update --github-labels "automated pr"