diff --git a/bazel/toolchains/container_images.bzl b/bazel/toolchains/container_images.bzl
index cd82c6faec..a8e069966c 100644
--- a/bazel/toolchains/container_images.bzl
+++ b/bazel/toolchains/container_images.bzl
@@ -7,7 +7,7 @@ load("@rules_oci//oci:pull.bzl", "oci_pull")
 def containter_image_deps():
     oci_pull(
         name = "distroless_static",
-        digest = "sha256:f4a57e8ffd7ba407bdd0eb315bb54ef1f21a2100a7f032e9102e4da34fe7c196",
+        digest = "sha256:5c7e2b465ac6a2a4e5f4f7f722ce43b147dabe87cb21ac6c4007ae5178a1fa58",
         image = "gcr.io/distroless/static",
         platforms = [
             "linux/amd64",
diff --git a/bazel/toolchains/nixpkgs_deps.bzl b/bazel/toolchains/nixpkgs_deps.bzl
index c28c10cef7..d5391d01e4 100644
--- a/bazel/toolchains/nixpkgs_deps.bzl
+++ b/bazel/toolchains/nixpkgs_deps.bzl
@@ -5,11 +5,11 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 def nixpkgs_deps():
     http_archive(
         name = "io_tweag_rules_nixpkgs",
-        sha256 = "1ce13c13a2f354fd37016d9fb333efeddcb308e89db9b3a8f45eafce57746f49",
-        strip_prefix = "rules_nixpkgs-668609f0b3627751651cb325166d0e95062be3f7",
+        sha256 = "0f7ac344873873d89f8286b4971401dca4a1b249421c2f7c7b56a1befe4501cb",
+        strip_prefix = "rules_nixpkgs-4e169eefd4e9cf38a3569e0b463e93f0c7a3c181",
         urls = [
-            "https://cdn.confidential.cloud/constellation/cas/sha256/1ce13c13a2f354fd37016d9fb333efeddcb308e89db9b3a8f45eafce57746f49",
-            "https://github.com/tweag/rules_nixpkgs/archive/668609f0b3627751651cb325166d0e95062be3f7.tar.gz",
+            "https://cdn.confidential.cloud/constellation/cas/sha256/0f7ac344873873d89f8286b4971401dca4a1b249421c2f7c7b56a1befe4501cb",
+            "https://github.com/tweag/rules_nixpkgs/archive/4e169eefd4e9cf38a3569e0b463e93f0c7a3c181.tar.gz",
         ],
         type = "tar.gz",
     )