diff --git a/build/Dockerfile b/build/Dockerfile
index 38771906..5ec44d21 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -82,6 +82,7 @@ RUN \
     # Install system dependencies required for the next instructions or debugging.
     # Note: tini is a helper for reaping zombie processes.
     apt-get update -qq &&\
+    apt-get upgrade -yqq &&\
     DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends curl gnupg tini python3 default-jre-headless &&\
     # Cleanup.
     # Note: the Debian image does automatically a clean after each install thanks to a hook.
@@ -96,6 +97,7 @@ RUN \
     # https://help.accusoft.com/PrizmDoc/v12.1/HTML/Installing_Asian_Fonts_on_Ubuntu_and_Debian.html.
     curl -o ./ttf-mscorefonts-installer_3.8.1_all.deb http://httpredir.debian.org/debian/pool/contrib/m/msttcorefonts/ttf-mscorefonts-installer_3.8.1_all.deb &&\
     apt-get update -qq &&\
+    apt-get upgrade -yqq &&\
     DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
     ./ttf-mscorefonts-installer_3.8.1_all.deb \
     culmus \
@@ -154,10 +156,12 @@ RUN \
       curl https://dl.google.com/linux/linux_signing_key.pub | apt-key add - &&\
       echo "deb http://dl.google.com/linux/chrome/deb/ stable main" | tee /etc/apt/sources.list.d/google-chrome.list &&\
       apt-get update -qq &&\
+      apt-get upgrade -yqq &&\
       DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends --allow-unauthenticated google-chrome-stable &&\
       mv /usr/bin/google-chrome-stable /usr/bin/chromium; \
     elif [[ "$(dpkg --print-architecture)" == "armhf" ]]; then \
       apt-get update -qq &&\
+      apt-get upgrade -yqq &&\
       DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends devscripts &&\
       debsnap chromium-common "$TMP_CHOMIUM_VERSION_ARMHF" -v --force --binary --architecture armhf &&\
       debsnap chromium "$TMP_CHOMIUM_VERSION_ARMHF" -v --force --binary --architecture armhf &&\
@@ -166,6 +170,7 @@ RUN \
       rm -rf ./binary-chromium-common/* ./binary-chromium/*; \
     else \
       apt-get update -qq &&\
+      apt-get upgrade -yqq &&\
       DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends chromium; \
     fi' &&\
     # Verify installation.
@@ -177,6 +182,7 @@ RUN \
     # Install LibreOffice & unoconverter.
     echo "deb http://deb.debian.org/debian bookworm-backports main" >> /etc/apt/sources.list &&\
     apt-get update -qq &&\
+    apt-get upgrade -yqq &&\
     DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends -t bookworm-backports libreoffice &&\
     curl -Ls https://raw.githubusercontent.com/gotenberg/unoconverter/v0.0.1/unoconv -o /usr/bin/unoconverter &&\
     chmod +x /usr/bin/unoconverter &&\
@@ -196,6 +202,7 @@ RUN \
     echo '#!/bin/bash\n\nexec java -jar /usr/bin/pdftk-all.jar "$@"' > /usr/bin/pdftk && \
     chmod +x /usr/bin/pdftk &&\
     apt-get update -qq &&\
+    apt-get upgrade -yqq &&\
     DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends qpdf exiftool &&\
     # See https://github.com/nextcloud/docker/issues/380.
     mkdir -p /usr/share/man/man1 &&\
diff --git a/test/Dockerfile b/test/Dockerfile
index 5011f506..a0dad3ff 100644
--- a/test/Dockerfile
+++ b/test/Dockerfile
@@ -19,6 +19,7 @@ ENV CGO_ENABLED=1
 COPY --from=golang /usr/local/go /usr/local/go
 
 RUN apt-get update -qq &&\
+    apt-get upgrade -yqq &&\
     apt-get install -y -qq --no-install-recommends  \
     sudo \
     # gcc for cgo.