diff --git a/platform/keycloak/client-secret-reconciler.yaml b/platform/keycloak/client-secret-reconciler.yaml
index 9e9f9f7..535e919 100644
--- a/platform/keycloak/client-secret-reconciler.yaml
+++ b/platform/keycloak/client-secret-reconciler.yaml
@@ -1224,7 +1224,7 @@ spec:
               # curlimages elsewhere in the repo. Renovate does not manage plain
               # `image:` tags (renovate.json disables image-tag updates so it never
               # fights Flux image-automation), so this is bumped by hand.
-              image: python:3.13.15-alpine3.23
+              image: python:3.15.2-alpine3.23
               imagePullPolicy: IfNotPresent
               command:
                 - python3
diff --git a/platform/keycloak/passkey-reconciler.yaml b/platform/keycloak/passkey-reconciler.yaml
index 6b346f1..811c850 100644
--- a/platform/keycloak/passkey-reconciler.yaml
+++ b/platform/keycloak/passkey-reconciler.yaml
@@ -3205,7 +3205,7 @@ spec:
               # sibling's pod on prod runs a different digest under this same tag.
               # Renovate's `kubernetes` manager covers platform/** (renovate.json5), so
               # it proposes tag and digest bumps for this line like any other image.
-              image: python:3.13.15-alpine3.23@sha256:6438599575cca0d1df94aeee0d2ae088d4d8846eab554b2ee7784a3a6df0d516
+              image: python:3.15.2-alpine3.23@sha256:8d77d813a53e534dec9e1e5182cbd5b651b70d63b27e4ea7c1f616b37cf9aad2
               imagePullPolicy: IfNotPresent
               command:
                 - python3