From ddff74ce84f9e1efe93d17f1114dd36feebcd90e Mon Sep 17 00:00:00 2001
From: "konflux-internal-p02[bot]"
 <170854209+konflux-internal-p02[bot]@users.noreply.github.com>
Date: Tue, 10 Nov 2026 05:11:15 +0000
Subject: [PATCH] chore(deps): update
 registry.redhat.io/ubi9/ubi-minimal-pqc:9.8 docker digest to d638f3b

Signed-off-by: konflux-internal-p02 <170854209+konflux-internal-p02[bot]@users.noreply.github.com>
---
 deploy/docker/Dockerfile.konflux.cli        | 2 +-
 deploy/docker/Dockerfile.konflux.gateway    | 2 +-
 deploy/docker/Dockerfile.konflux.supervisor | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/docker/Dockerfile.konflux.cli b/deploy/docker/Dockerfile.konflux.cli
index 1cdc2cb458..5f2c31da1d 100644
--- a/deploy/docker/Dockerfile.konflux.cli
+++ b/deploy/docker/Dockerfile.konflux.cli
@@ -103,7 +103,7 @@ RUN . /tmp/build-env && \
 # ---------------------------------------------------------------------------
 # ubi-minimal-pqc already ships DEFAULT:PQ, so this stage does not install
 # crypto-policies-scripts (and the Python stack it pulls).
-FROM registry.redhat.io/ubi9/ubi-minimal-pqc:9.8@sha256:ddaf8f8a845a39f7ab7d7caaed1bed0b9063eab6e22e52beece0924e91666c86
+FROM registry.redhat.io/ubi9/ubi-minimal-pqc:9.8@sha256:d638f3b49b79575329aacdae2739f954effe2467c12147711e73445c4fc97819
 
 RUN microdnf install -y --nodocs ca-certificates git-core \
     && microdnf clean all
diff --git a/deploy/docker/Dockerfile.konflux.gateway b/deploy/docker/Dockerfile.konflux.gateway
index 6f7024b746..fe0ca38373 100644
--- a/deploy/docker/Dockerfile.konflux.gateway
+++ b/deploy/docker/Dockerfile.konflux.gateway
@@ -84,7 +84,7 @@ RUN VER="${OPENSHELL_VERSION#v}" \
 # ---------------------------------------------------------------------------
 # ubi-minimal-pqc already ships DEFAULT:PQ, so this stage does not install
 # crypto-policies-scripts (and the Python stack it pulls).
-FROM registry.redhat.io/ubi9/ubi-minimal-pqc:9.8@sha256:ddaf8f8a845a39f7ab7d7caaed1bed0b9063eab6e22e52beece0924e91666c86
+FROM registry.redhat.io/ubi9/ubi-minimal-pqc:9.8@sha256:d638f3b49b79575329aacdae2739f954effe2467c12147711e73445c4fc97819
 
 RUN microdnf install -y --nodocs --setopt=install_weak_deps=0 \
         ca-certificates \
diff --git a/deploy/docker/Dockerfile.konflux.supervisor b/deploy/docker/Dockerfile.konflux.supervisor
index a3ac551247..637148a30f 100644
--- a/deploy/docker/Dockerfile.konflux.supervisor
+++ b/deploy/docker/Dockerfile.konflux.supervisor
@@ -105,7 +105,7 @@ RUN . /tmp/build-env && \
 # ---------------------------------------------------------------------------
 # ubi-minimal-pqc already ships DEFAULT:PQ. No runtime RPMs: the binary is
 # copied onto the base as-is, so this stage has no Hermeto RPM prefetch.
-FROM registry.redhat.io/ubi9/ubi-minimal-pqc:9.8@sha256:ddaf8f8a845a39f7ab7d7caaed1bed0b9063eab6e22e52beece0924e91666c86
+FROM registry.redhat.io/ubi9/ubi-minimal-pqc:9.8@sha256:d638f3b49b79575329aacdae2739f954effe2467c12147711e73445c4fc97819
 
 # Fail the build if the PQC base stops shipping DEFAULT:PQ.
 RUN test "$(cat /etc/crypto-policies/config)" = "DEFAULT:PQ"