diff --git a/examples/docker/aiohttp/Dockerfile b/examples/docker/aiohttp/Dockerfile
index a7b78ed12..148921db0 100644
--- a/examples/docker/aiohttp/Dockerfile
+++ b/examples/docker/aiohttp/Dockerfile
@@ -1,13 +1,32 @@
 #
 # docker build . -t your-repo/hello-bolt
 #
-FROM python:3.8.5-slim-buster as builder
+FROM python:3.8-slim-bookworm as builder
 RUN apt-get update && apt-get clean
 COPY requirements.txt /build/
 WORKDIR /build/
 RUN pip install -U pip && pip install -r requirements.txt
 
-FROM python:3.8.5-slim-buster as app
+FROM python:3.8-slim-bookworm as app
+# eMudhra 53119: refresh the OS trust store and fail the build unless the
+# ca-certificates package carries the distrust fix for this Debian suite.
+ARG CA_CERTIFICATES_REFRESH=2026-10-21
+RUN set -eu; \
+    . /etc/os-release; \
+    case "$VERSION_CODENAME" in \
+      bookworm) min="20250419~deb12u2" ;; \
+      trixie) min="20250419+deb13u1" ;; \
+      *) echo "ca-certificates gate: no fixed package known for '$VERSION_CODENAME'" >&2; exit 1 ;; \
+    esac; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ca-certificates; \
+    rm -rf /var/lib/apt/lists/*; \
+    v="$(dpkg-query -W -f='${Version}' ca-certificates)"; \
+    if dpkg --compare-versions "$v" ge "$min"; then \
+      echo "ca-certificates gate OK: $VERSION_CODENAME $v >= $min"; \
+    else \
+      echo "ca-certificates gate FAILED: $VERSION_CODENAME $v < $min" >&2; exit 1; \
+    fi
 COPY --from=builder /build/ /app/
 COPY --from=builder /usr/local/lib/ /usr/local/lib/
 WORKDIR /app/
diff --git a/examples/docker/asgi/Dockerfile b/examples/docker/asgi/Dockerfile
index cef704967..82b58b27c 100644
--- a/examples/docker/asgi/Dockerfile
+++ b/examples/docker/asgi/Dockerfile
@@ -1,12 +1,24 @@
 #
 # docker build . -t your-repo/hello-bolt
 #
-FROM python:3.11-alpine3.17 as builder
+FROM python:3.11-alpine3.20 as builder
 COPY requirements.txt /build/
 WORKDIR /build/
 RUN pip install -U pip && pip install -r requirements.txt
 
-FROM python:3.11-alpine3.17 as app
+FROM python:3.11-alpine3.20 as app
+# eMudhra 53119: refresh the OS trust store and fail the build unless
+# ca-certificates carries the distrust fix (>= 20261020-r0).
+ARG CA_CERTIFICATES_REFRESH=2026-10-21
+RUN set -eu; \
+    apk add --no-cache --upgrade ca-certificates ca-certificates-bundle; \
+    for p in ca-certificates ca-certificates-bundle; do \
+      v="$(apk info -e -v "$p" | sed "s/^$p-//")"; \
+      case "$(apk version -t "${v:-0}" 20261020-r0)" in \
+        "="|">") echo "ca-certificates gate OK: $p $v >= 20261020-r0" ;; \
+        *) echo "ca-certificates gate FAILED: $p ${v:-missing} < 20261020-r0" >&2; exit 1 ;; \
+      esac; \
+    done
 WORKDIR /app/
 COPY --from=builder /usr/local/bin/ /usr/local/bin/
 COPY --from=builder /usr/local/lib/ /usr/local/lib/
diff --git a/examples/docker/fastapi-gunicorn/Dockerfile b/examples/docker/fastapi-gunicorn/Dockerfile
index c8f8b94e3..c80bc0682 100644
--- a/examples/docker/fastapi-gunicorn/Dockerfile
+++ b/examples/docker/fastapi-gunicorn/Dockerfile
@@ -2,6 +2,25 @@
 # docker build . -t your-repo/hello-bolt
 #
 FROM tiangolo/uvicorn-gunicorn:python3.8-slim
+# eMudhra 53119: refresh the OS trust store and fail the build unless the
+# ca-certificates package carries the distrust fix for this Debian suite.
+ARG CA_CERTIFICATES_REFRESH=2026-10-21
+RUN set -eu; \
+    . /etc/os-release; \
+    case "$VERSION_CODENAME" in \
+      bookworm) min="20250419~deb12u2" ;; \
+      trixie) min="20250419+deb13u1" ;; \
+      *) echo "ca-certificates gate: no fixed package known for '$VERSION_CODENAME'" >&2; exit 1 ;; \
+    esac; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ca-certificates; \
+    rm -rf /var/lib/apt/lists/*; \
+    v="$(dpkg-query -W -f='${Version}' ca-certificates)"; \
+    if dpkg --compare-versions "$v" ge "$min"; then \
+      echo "ca-certificates gate OK: $VERSION_CODENAME $v >= $min"; \
+    else \
+      echo "ca-certificates gate FAILED: $VERSION_CODENAME $v < $min" >&2; exit 1; \
+    fi
 WORKDIR /app/
 COPY *.py /app/
 COPY requirements.txt /app/
diff --git a/examples/docker/flask-gunicorn/Dockerfile b/examples/docker/flask-gunicorn/Dockerfile
index e788cb388..1c1595044 100644
--- a/examples/docker/flask-gunicorn/Dockerfile
+++ b/examples/docker/flask-gunicorn/Dockerfile
@@ -1,12 +1,31 @@
 #
 # docker build . -t your-repo/hello-bolt
 #
-FROM python:3.8.5-slim-buster as builder
+FROM python:3.8-slim-bookworm as builder
 COPY requirements.txt /build/
 WORKDIR /build/
 RUN pip install -U pip && pip install -r requirements.txt
 
-FROM python:3.8.5-slim-buster as app
+FROM python:3.8-slim-bookworm as app
+# eMudhra 53119: refresh the OS trust store and fail the build unless the
+# ca-certificates package carries the distrust fix for this Debian suite.
+ARG CA_CERTIFICATES_REFRESH=2026-10-21
+RUN set -eu; \
+    . /etc/os-release; \
+    case "$VERSION_CODENAME" in \
+      bookworm) min="20250419~deb12u2" ;; \
+      trixie) min="20250419+deb13u1" ;; \
+      *) echo "ca-certificates gate: no fixed package known for '$VERSION_CODENAME'" >&2; exit 1 ;; \
+    esac; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ca-certificates; \
+    rm -rf /var/lib/apt/lists/*; \
+    v="$(dpkg-query -W -f='${Version}' ca-certificates)"; \
+    if dpkg --compare-versions "$v" ge "$min"; then \
+      echo "ca-certificates gate OK: $VERSION_CODENAME $v >= $min"; \
+    else \
+      echo "ca-certificates gate FAILED: $VERSION_CODENAME $v < $min" >&2; exit 1; \
+    fi
 WORKDIR /app/
 COPY --from=builder /usr/local/bin/ /usr/local/bin/
 COPY --from=builder /usr/local/lib/ /usr/local/lib/
diff --git a/examples/docker/flask-uwsgi/Dockerfile b/examples/docker/flask-uwsgi/Dockerfile
index 14ddfb41b..875925147 100644
--- a/examples/docker/flask-uwsgi/Dockerfile
+++ b/examples/docker/flask-uwsgi/Dockerfile
@@ -1,15 +1,34 @@
 #
 # docker build . -t your-repo/hello-bolt
 #
-FROM python:3.8.5-slim-buster as builder
+FROM python:3.8-slim-bookworm as builder
 RUN apt-get update \
-    && apt-get -y install build-essential libpcre3-dev \
+    && apt-get -y install build-essential libpcre2-dev \
     && apt-get clean
 COPY requirements.txt /build/
 WORKDIR /build/
 RUN pip install -U pip && pip install -r requirements.txt
 
-FROM python:3.8.5-slim-buster as app
+FROM python:3.8-slim-bookworm as app
+# eMudhra 53119: refresh the OS trust store and fail the build unless the
+# ca-certificates package carries the distrust fix for this Debian suite.
+ARG CA_CERTIFICATES_REFRESH=2026-10-21
+RUN set -eu; \
+    . /etc/os-release; \
+    case "$VERSION_CODENAME" in \
+      bookworm) min="20250419~deb12u2" ;; \
+      trixie) min="20250419+deb13u1" ;; \
+      *) echo "ca-certificates gate: no fixed package known for '$VERSION_CODENAME'" >&2; exit 1 ;; \
+    esac; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ca-certificates; \
+    rm -rf /var/lib/apt/lists/*; \
+    v="$(dpkg-query -W -f='${Version}' ca-certificates)"; \
+    if dpkg --compare-versions "$v" ge "$min"; then \
+      echo "ca-certificates gate OK: $VERSION_CODENAME $v >= $min"; \
+    else \
+      echo "ca-certificates gate FAILED: $VERSION_CODENAME $v < $min" >&2; exit 1; \
+    fi
 WORKDIR /app/
 COPY --from=builder /usr/local/bin/ /usr/local/bin/
 COPY --from=builder /usr/local/lib/ /usr/local/lib/
diff --git a/examples/docker/sanic/Dockerfile b/examples/docker/sanic/Dockerfile
index 4606e68bd..03fb26059 100644
--- a/examples/docker/sanic/Dockerfile
+++ b/examples/docker/sanic/Dockerfile
@@ -1,12 +1,31 @@
 #
 # docker build . -t your-repo/hello-bolt
 #
-FROM python:3.8.5-slim-buster as builder
+FROM python:3.8-slim-bookworm as builder
 COPY requirements.txt /build/
 WORKDIR /build/
 RUN pip install -U pip && pip install -r requirements.txt
 
-FROM python:3.8.5-slim-buster as app
+FROM python:3.8-slim-bookworm as app
+# eMudhra 53119: refresh the OS trust store and fail the build unless the
+# ca-certificates package carries the distrust fix for this Debian suite.
+ARG CA_CERTIFICATES_REFRESH=2026-10-21
+RUN set -eu; \
+    . /etc/os-release; \
+    case "$VERSION_CODENAME" in \
+      bookworm) min="20250419~deb12u2" ;; \
+      trixie) min="20250419+deb13u1" ;; \
+      *) echo "ca-certificates gate: no fixed package known for '$VERSION_CODENAME'" >&2; exit 1 ;; \
+    esac; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ca-certificates; \
+    rm -rf /var/lib/apt/lists/*; \
+    v="$(dpkg-query -W -f='${Version}' ca-certificates)"; \
+    if dpkg --compare-versions "$v" ge "$min"; then \
+      echo "ca-certificates gate OK: $VERSION_CODENAME $v >= $min"; \
+    else \
+      echo "ca-certificates gate FAILED: $VERSION_CODENAME $v < $min" >&2; exit 1; \
+    fi
 WORKDIR /app/
 COPY *.py /app/
 COPY --from=builder /usr/local/bin/ /usr/local/bin/
diff --git a/examples/google_cloud_run/aiohttp/Dockerfile b/examples/google_cloud_run/aiohttp/Dockerfile
index e4432e3a2..c0cbc9ac4 100644
--- a/examples/google_cloud_run/aiohttp/Dockerfile
+++ b/examples/google_cloud_run/aiohttp/Dockerfile
@@ -11,7 +11,27 @@
 # ----------------------------------------------
 # Use the official lightweight Python image.
 # https://hub.docker.com/_/python
-FROM python:3.8.5-slim-buster
+FROM python:3.8-slim-bookworm
+
+# eMudhra 53119: refresh the OS trust store and fail the build unless the
+# ca-certificates package carries the distrust fix for this Debian suite.
+ARG CA_CERTIFICATES_REFRESH=2026-10-21
+RUN set -eu; \
+    . /etc/os-release; \
+    case "$VERSION_CODENAME" in \
+      bookworm) min="20250419~deb12u2" ;; \
+      trixie) min="20250419+deb13u1" ;; \
+      *) echo "ca-certificates gate: no fixed package known for '$VERSION_CODENAME'" >&2; exit 1 ;; \
+    esac; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ca-certificates; \
+    rm -rf /var/lib/apt/lists/*; \
+    v="$(dpkg-query -W -f='${Version}' ca-certificates)"; \
+    if dpkg --compare-versions "$v" ge "$min"; then \
+      echo "ca-certificates gate OK: $VERSION_CODENAME $v >= $min"; \
+    else \
+      echo "ca-certificates gate FAILED: $VERSION_CODENAME $v < $min" >&2; exit 1; \
+    fi
 
 # Allow statements and log messages to immediately appear in the Knative logs
 ENV PYTHONUNBUFFERED True
diff --git a/examples/google_cloud_run/flask-gunicorn/Dockerfile b/examples/google_cloud_run/flask-gunicorn/Dockerfile
index 8342e3a8b..7c76fa745 100644
--- a/examples/google_cloud_run/flask-gunicorn/Dockerfile
+++ b/examples/google_cloud_run/flask-gunicorn/Dockerfile
@@ -11,7 +11,27 @@
 # ----------------------------------------------
 # Use the official lightweight Python image.
 # https://hub.docker.com/_/python
-FROM python:3.8.5-slim-buster
+FROM python:3.8-slim-bookworm
+
+# eMudhra 53119: refresh the OS trust store and fail the build unless the
+# ca-certificates package carries the distrust fix for this Debian suite.
+ARG CA_CERTIFICATES_REFRESH=2026-10-21
+RUN set -eu; \
+    . /etc/os-release; \
+    case "$VERSION_CODENAME" in \
+      bookworm) min="20250419~deb12u2" ;; \
+      trixie) min="20250419+deb13u1" ;; \
+      *) echo "ca-certificates gate: no fixed package known for '$VERSION_CODENAME'" >&2; exit 1 ;; \
+    esac; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ca-certificates; \
+    rm -rf /var/lib/apt/lists/*; \
+    v="$(dpkg-query -W -f='${Version}' ca-certificates)"; \
+    if dpkg --compare-versions "$v" ge "$min"; then \
+      echo "ca-certificates gate OK: $VERSION_CODENAME $v >= $min"; \
+    else \
+      echo "ca-certificates gate FAILED: $VERSION_CODENAME $v < $min" >&2; exit 1; \
+    fi
 
 # Allow statements and log messages to immediately appear in the Knative logs
 ENV PYTHONUNBUFFERED True
diff --git a/examples/google_cloud_run/sanic/Dockerfile b/examples/google_cloud_run/sanic/Dockerfile
index d71ddef67..1b2195fda 100644
--- a/examples/google_cloud_run/sanic/Dockerfile
+++ b/examples/google_cloud_run/sanic/Dockerfile
@@ -11,7 +11,27 @@
 # ----------------------------------------------
 # Use the official lightweight Python image.
 # https://hub.docker.com/_/python
-FROM python:3.8.5-slim-buster
+FROM python:3.8-slim-bookworm
+
+# eMudhra 53119: refresh the OS trust store and fail the build unless the
+# ca-certificates package carries the distrust fix for this Debian suite.
+ARG CA_CERTIFICATES_REFRESH=2026-10-21
+RUN set -eu; \
+    . /etc/os-release; \
+    case "$VERSION_CODENAME" in \
+      bookworm) min="20250419~deb12u2" ;; \
+      trixie) min="20250419+deb13u1" ;; \
+      *) echo "ca-certificates gate: no fixed package known for '$VERSION_CODENAME'" >&2; exit 1 ;; \
+    esac; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ca-certificates; \
+    rm -rf /var/lib/apt/lists/*; \
+    v="$(dpkg-query -W -f='${Version}' ca-certificates)"; \
+    if dpkg --compare-versions "$v" ge "$min"; then \
+      echo "ca-certificates gate OK: $VERSION_CODENAME $v >= $min"; \
+    else \
+      echo "ca-certificates gate FAILED: $VERSION_CODENAME $v < $min" >&2; exit 1; \
+    fi
 
 # Allow statements and log messages to immediately appear in the Knative logs
 ENV PYTHONUNBUFFERED True