diff --git a/docs/gitea-actions.md b/docs/gitea-actions.md
index d031482..efe18b0 100644
--- a/docs/gitea-actions.md
+++ b/docs/gitea-actions.md
@@ -42,7 +42,7 @@ branch slug; stable promotions share one group and are not cancelled in progress
 ## Runners and permissions
 
 Every job that runs project commands uses Bun 1.4.3 with the frozen lockfile (see [Bun toolchain and Node](#bun-toolchain-and-node)). Job containers stay on Node 24.21.0. The image
-job uses Docker 29.8.2 and its matching Docker-in-Docker service. Scanner
+job uses Docker 29.9.1 and its matching Docker-in-Docker service. Scanner
 versions are Semgrep 1.180.0 and Trivy 0.75.0; Trivy downloads are checksum-checked.
 Trivy downloads its vulnerability database from Aqua's public ECR mirror because
 the default registries returned a missing database blob and a download timeout.