diff --git a/.gitea/workflows/docker-publish.yml b/.gitea/workflows/docker-publish.yml
index 1ac9a06..aeab739 100644
--- a/.gitea/workflows/docker-publish.yml
+++ b/.gitea/workflows/docker-publish.yml
@@ -57,14 +57,14 @@ env:
   BUILDX_VERSION: "0.35.0"
   BUILDX_SHA256: "d41ece72044243b4f58b343441ae37446d9c29a7d6b5e11c61847bbcf8f7dfda"
   BINFMT_IMAGE: "tonistiigi/binfmt:qemu-v10.2.3"
-  TRIVY_VERSION: "0.72.0"
-  TRIVY_SHA256: "bbb64b9695866ce4a7a8f5c9592002c5961cab378577fa3f8a040df362b9b2ea"
+  TRIVY_VERSION: "0.74.0"
+  TRIVY_SHA256: "2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a"
 
 jobs:
   publish:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.1.0
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}
diff --git a/.gitea/workflows/image-security-checks.yml b/.gitea/workflows/image-security-checks.yml
index c1c6501..46e4bde 100644
--- a/.gitea/workflows/image-security-checks.yml
+++ b/.gitea/workflows/image-security-checks.yml
@@ -21,7 +21,7 @@ jobs:
   scan:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.1.0
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}
@@ -48,8 +48,8 @@ jobs:
           # checksum, never "latest": Trivy releases were compromised in the
           # March 2026 supply-chain incident (malicious v0.69.4). Keep in sync
           # with the ARGs in the PipelineImage Dockerfiles.
-          TRIVY_VERSION=0.72.0
-          TRIVY_SHA256=bbb64b9695866ce4a7a8f5c9592002c5961cab378577fa3f8a040df362b9b2ea
+          TRIVY_VERSION=0.74.0
+          TRIVY_SHA256=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
           if ! command -v trivy >/dev/null 2>&1; then
             echo "=== Trivy not in runner image, installing v${TRIVY_VERSION} ==="
             curl -sSfLO "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
diff --git a/.gitea/workflows/python-checks.yml b/.gitea/workflows/python-checks.yml
index 5270f9a..ed9b98a 100644
--- a/.gitea/workflows/python-checks.yml
+++ b/.gitea/workflows/python-checks.yml
@@ -29,7 +29,7 @@ jobs:
   check:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.1.0
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}
diff --git a/.gitea/workflows/python-package-publish.yml b/.gitea/workflows/python-package-publish.yml
index deb184d..3e0c79e 100644
--- a/.gitea/workflows/python-package-publish.yml
+++ b/.gitea/workflows/python-package-publish.yml
@@ -30,7 +30,7 @@ jobs:
   publish:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.1.0
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}
diff --git a/.gitea/workflows/python-security-checks.yml b/.gitea/workflows/python-security-checks.yml
index 47f41af..8dabb63 100644
--- a/.gitea/workflows/python-security-checks.yml
+++ b/.gitea/workflows/python-security-checks.yml
@@ -20,7 +20,7 @@ jobs:
   security:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.1.0
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}