diff --git a/dstack/build/shared/pin-packages.sh b/dstack/build/shared/pin-packages.sh
index dbc036ad0..840c7b1af 100755
--- a/dstack/build/shared/pin-packages.sh
+++ b/dstack/build/shared/pin-packages.sh
@@ -15,7 +15,7 @@
 set -e
 
 PKG_LIST=$1
-SNAPSHOT_DATE=${SNAPSHOT_DATE:-20260317T000000Z}
+SNAPSHOT_DATE=${SNAPSHOT_DATE:-20261021T000000Z}
 
 if [ -z "$PKG_LIST" ]; then
     echo "Usage: $0 <pkg-list-file>" >&2
diff --git a/dstack/gateway/dstack-app/builder/shared/builder-pinned-packages.txt b/dstack/gateway/dstack-app/builder/shared/builder-pinned-packages.txt
index e390e80bc..568d740a4 100644
--- a/dstack/gateway/dstack-app/builder/shared/builder-pinned-packages.txt
+++ b/dstack/gateway/dstack-app/builder/shared/builder-pinned-packages.txt
@@ -309,10 +309,10 @@ libpng16-16t64:amd64=1.6.48-1
 libpq-dev=17.6-0+deb13u1
 libpq5:amd64=17.6-0+deb13u1
 libproc2-0:amd64=2:4.0.4-9
-libprotobuf-dev:amd64=3.21.12-11
-libprotobuf-lite32t64:amd64=3.21.12-11
-libprotobuf32t64:amd64=3.21.12-11
-libprotoc32t64:amd64=3.21.12-11
+libprotobuf-dev:amd64=3.21.12-11+deb13u1
+libprotobuf-lite32t64:amd64=3.21.12-11+deb13u1
+libprotobuf32t64:amd64=3.21.12-11+deb13u1
+libprotoc32t64:amd64=3.21.12-11+deb13u1
 libpsl-dev:amd64=0.21.2-1.1+b1
 libpsl5t64:amd64=0.21.2-1.1+b1
 libpython3-stdlib:amd64=3.13.5-1
@@ -347,8 +347,8 @@ libsqlite3-0:amd64=3.46.1-7
 libsqlite3-dev:amd64=3.46.1-7
 libssh2-1-dev:amd64=1.11.1-1
 libssh2-1t64:amd64=1.11.1-1
-libssl-dev:amd64=3.5.5-1~deb13u1
-libssl3t64:amd64=3.5.5-1~deb13u1
+libssl-dev:amd64=3.5.7-1~deb13u3
+libssl3t64:amd64=3.5.7-1~deb13u3
 libstdc++-14-dev:amd64=14.2.0-19
 libstdc++6:amd64=14.2.0-19
 libsvn1:amd64=1.14.5-3
@@ -424,9 +424,9 @@ media-types=13.0.0
 mercurial-common=7.0.1-2
 mercurial=7.0.1-2
 mount=2.41-5
-musl-dev:amd64=1.2.5-3
-musl-tools=1.2.5-3
-musl:amd64=1.2.5-3
+musl-dev:amd64=1.2.5-3.1~deb13u1
+musl-tools=1.2.5-3.1~deb13u1
+musl:amd64=1.2.5-3.1~deb13u1
 mysql-common=5.8+1.1.1
 native-architecture=0.2.6
 ncurses-base=6.5+20250216-2
@@ -434,8 +434,8 @@ ncurses-bin=6.5+20250216-2
 netbase=6.5
 nettle-dev:amd64=3.10.1-1
 openssh-client=1:10.0p1-7
-openssl-provider-legacy=3.5.5-1~deb13u1
-openssl=3.5.5-1~deb13u1
+openssl-provider-legacy=3.5.7-1~deb13u3
+openssl=3.5.7-1~deb13u3
 pango1.0-tools=1.56.3-1
 passwd=1:4.17.4-2
 patch=2.8-2
@@ -446,7 +446,7 @@ pinentry-curses=1.3.1-2
 pkgconf-bin=1.8.1-4
 pkgconf:amd64=1.8.1-4
 procps=2:4.0.4-9
-protobuf-compiler=3.21.12-11
+protobuf-compiler=3.21.12-11+deb13u1
 python3-minimal=3.13.5-1
 python3-packaging=25.0-1
 python3.13-minimal=3.13.5-2
diff --git a/dstack/gateway/dstack-app/builder/shared/pinned-packages.txt b/dstack/gateway/dstack-app/builder/shared/pinned-packages.txt
index f45296ccd..4efad8116 100644
--- a/dstack/gateway/dstack-app/builder/shared/pinned-packages.txt
+++ b/dstack/gateway/dstack-app/builder/shared/pinned-packages.txt
@@ -4,7 +4,7 @@ base-files=12.4+deb12u11
 base-passwd=3.6.1
 bash=5.2.15-2+b8
 bsdutils=1:2.38.1-5+deb12u3
-ca-certificates=20230311+deb12u1
+ca-certificates=20250419~deb12u2
 coreutils=9.1-1
 dash=0.5.12-2
 debconf=1.5.82
@@ -23,7 +23,7 @@ gzip=1.12-1
 hostname=3.23+nmu1
 init-system-helpers=1.65.2
 iproute2=6.1.0-3
-jq=1.6-2.1+deb12u1
+jq=1.6-2.1+deb12u3
 libacl1:amd64=2.3.1-3
 libapt-pkg6.0:amd64=2.6.1
 libattr1:amd64=1:2.5.1-4
@@ -37,11 +37,11 @@ libbz2-1.0:amd64=1.0.8-5+b1
 libc-bin=2.36-9+deb12u10
 libc6:amd64=2.36-9+deb12u10
 libcap-ng0:amd64=0.8.3-1+b3
-libcap2-bin=1:2.66-4+deb12u2+b2
-libcap2:amd64=1:2.66-4+deb12u2+b2
+libcap2-bin=1:2.66-4+deb12u3+b1
+libcap2:amd64=1:2.66-4+deb12u3+b1
 libcom-err2:amd64=1.47.0-2
 libcrypt1:amd64=1:4.4.33-2
-libcurl3-gnutls:amd64=7.88.1-10+deb12u14
+libcurl3-gnutls:amd64=7.88.1-10+deb12u15
 libdb5.3:amd64=5.3.28+dfsg2-1
 libdebconfclient0:amd64=0.270
 libelf1:amd64=0.188-2.1
@@ -56,14 +56,14 @@ libgdbm6:amd64=1.23-3
 libgmp10:amd64=2:6.2.1+dfsg1-1.1
 libgnutls30:amd64=3.7.9-2+deb12u4
 libgpg-error0:amd64=1.46-1
-libgssapi-krb5-2:amd64=1.20.1-2+deb12u4
+libgssapi-krb5-2:amd64=1.20.1-2+deb12u5
 libhogweed6:amd64=3.8.1-2
 libidn2-0:amd64=2.3.3-1+b1
-libjq1:amd64=1.6-2.1+deb12u1
-libk5crypto3:amd64=1.20.1-2+deb12u4
+libjq1:amd64=1.6-2.1+deb12u3
+libk5crypto3:amd64=1.20.1-2+deb12u5
 libkeyutils1:amd64=1.6.3-2
-libkrb5-3:amd64=1.20.1-2+deb12u4
-libkrb5support0:amd64=1.20.1-2+deb12u4
+libkrb5-3:amd64=1.20.1-2+deb12u5
+libkrb5support0:amd64=1.20.1-2+deb12u5
 libldap-2.5-0:amd64=2.5.13+dfsg-5
 liblz4-1:amd64=1.9.4-1
 liblzma5:amd64=5.4.1-1
@@ -71,7 +71,7 @@ libmd0:amd64=1.0.4-2
 libmnl0:amd64=1.0.4-3
 libmount1:amd64=2.38.1-5+deb12u3
 libnettle8:amd64=3.8.1-2
-libnghttp2-14:amd64=1.52.0-1+deb12u2
+libnghttp2-14:amd64=1.52.0-1+deb12u3
 libonig5:amd64=6.9.8-1
 libp11-kit0:amd64=0.24.1-2
 libpam-modules-bin=1.5.2-6+deb12u1
@@ -92,7 +92,7 @@ libsepol2:amd64=3.4-2.1
 libsmartcols1:amd64=2.38.1-5+deb12u3
 libss2:amd64=1.47.0-2
 libssh2-1:amd64=1.10.0-3+b1
-libssl3:amd64=3.0.18-1~deb12u2
+libssl3:amd64=3.0.22-1~deb12u1
 libstdc++6:amd64=12.2.0-14+deb12u1
 libsystemd0:amd64=252.38-1~deb12u1
 libtasn1-6:amd64=4.19.0-2+deb12u1
@@ -111,7 +111,7 @@ mawk=1.3.4.20200120-3.1
 mount=2.38.1-5+deb12u3
 ncurses-base=6.4-4
 ncurses-bin=6.4-4
-openssl=3.0.18-1~deb12u2
+openssl=3.0.22-1~deb12u1
 passwd=1:4.13+dfsg1-1+deb12u1
 perl-base=5.36.0-7+deb12u3
 perl-modules-5.36=5.36.0-7+deb12u3
diff --git a/dstack/kms/dstack-app/builder/shared/builder-pinned-packages.txt b/dstack/kms/dstack-app/builder/shared/builder-pinned-packages.txt
index e390e80bc..568d740a4 100644
--- a/dstack/kms/dstack-app/builder/shared/builder-pinned-packages.txt
+++ b/dstack/kms/dstack-app/builder/shared/builder-pinned-packages.txt
@@ -309,10 +309,10 @@ libpng16-16t64:amd64=1.6.48-1
 libpq-dev=17.6-0+deb13u1
 libpq5:amd64=17.6-0+deb13u1
 libproc2-0:amd64=2:4.0.4-9
-libprotobuf-dev:amd64=3.21.12-11
-libprotobuf-lite32t64:amd64=3.21.12-11
-libprotobuf32t64:amd64=3.21.12-11
-libprotoc32t64:amd64=3.21.12-11
+libprotobuf-dev:amd64=3.21.12-11+deb13u1
+libprotobuf-lite32t64:amd64=3.21.12-11+deb13u1
+libprotobuf32t64:amd64=3.21.12-11+deb13u1
+libprotoc32t64:amd64=3.21.12-11+deb13u1
 libpsl-dev:amd64=0.21.2-1.1+b1
 libpsl5t64:amd64=0.21.2-1.1+b1
 libpython3-stdlib:amd64=3.13.5-1
@@ -347,8 +347,8 @@ libsqlite3-0:amd64=3.46.1-7
 libsqlite3-dev:amd64=3.46.1-7
 libssh2-1-dev:amd64=1.11.1-1
 libssh2-1t64:amd64=1.11.1-1
-libssl-dev:amd64=3.5.5-1~deb13u1
-libssl3t64:amd64=3.5.5-1~deb13u1
+libssl-dev:amd64=3.5.7-1~deb13u3
+libssl3t64:amd64=3.5.7-1~deb13u3
 libstdc++-14-dev:amd64=14.2.0-19
 libstdc++6:amd64=14.2.0-19
 libsvn1:amd64=1.14.5-3
@@ -424,9 +424,9 @@ media-types=13.0.0
 mercurial-common=7.0.1-2
 mercurial=7.0.1-2
 mount=2.41-5
-musl-dev:amd64=1.2.5-3
-musl-tools=1.2.5-3
-musl:amd64=1.2.5-3
+musl-dev:amd64=1.2.5-3.1~deb13u1
+musl-tools=1.2.5-3.1~deb13u1
+musl:amd64=1.2.5-3.1~deb13u1
 mysql-common=5.8+1.1.1
 native-architecture=0.2.6
 ncurses-base=6.5+20250216-2
@@ -434,8 +434,8 @@ ncurses-bin=6.5+20250216-2
 netbase=6.5
 nettle-dev:amd64=3.10.1-1
 openssh-client=1:10.0p1-7
-openssl-provider-legacy=3.5.5-1~deb13u1
-openssl=3.5.5-1~deb13u1
+openssl-provider-legacy=3.5.7-1~deb13u3
+openssl=3.5.7-1~deb13u3
 pango1.0-tools=1.56.3-1
 passwd=1:4.17.4-2
 patch=2.8-2
@@ -446,7 +446,7 @@ pinentry-curses=1.3.1-2
 pkgconf-bin=1.8.1-4
 pkgconf:amd64=1.8.1-4
 procps=2:4.0.4-9
-protobuf-compiler=3.21.12-11
+protobuf-compiler=3.21.12-11+deb13u1
 python3-minimal=3.13.5-1
 python3-packaging=25.0-1
 python3.13-minimal=3.13.5-2
diff --git a/dstack/kms/dstack-app/builder/shared/pinned-packages.txt b/dstack/kms/dstack-app/builder/shared/pinned-packages.txt
index e966045f9..34659193c 100644
--- a/dstack/kms/dstack-app/builder/shared/pinned-packages.txt
+++ b/dstack/kms/dstack-app/builder/shared/pinned-packages.txt
@@ -4,7 +4,7 @@ base-files=12.4+deb12u11
 base-passwd=3.6.1
 bash=5.2.15-2+b8
 bsdutils=1:2.38.1-5+deb12u3
-ca-certificates=20230311+deb12u1
+ca-certificates=20250419~deb12u2
 coreutils=9.1-1
 dash=0.5.12-2
 debconf=1.5.82
@@ -62,7 +62,7 @@ libsemanage2:amd64=3.4-1+b5
 libsepol2:amd64=3.4-2.1
 libsmartcols1:amd64=2.38.1-5+deb12u3
 libss2:amd64=1.47.0-2
-libssl3:amd64=3.0.18-1~deb12u2
+libssl3:amd64=3.0.22-1~deb12u1
 libstdc++6:amd64=12.2.0-14+deb12u1
 libsystemd0:amd64=252.38-1~deb12u1
 libtasn1-6:amd64=4.19.0-2+deb12u1
@@ -78,7 +78,7 @@ mawk=1.3.4.20200120-3.1
 mount=2.38.1-5+deb12u3
 ncurses-base=6.4-4
 ncurses-bin=6.4-4
-openssl=3.0.18-1~deb12u2
+openssl=3.0.22-1~deb12u1
 passwd=1:4.13+dfsg1-1+deb12u1
 perl-base=5.36.0-7+deb12u2
 sed=4.9-1
diff --git a/dstack/verifier/builder/shared/builder-pinned-packages.txt b/dstack/verifier/builder/shared/builder-pinned-packages.txt
index 75a2bc37d..8717df157 100644
--- a/dstack/verifier/builder/shared/builder-pinned-packages.txt
+++ b/dstack/verifier/builder/shared/builder-pinned-packages.txt
@@ -12,7 +12,7 @@ binutils=2.40-2
 bsdutils=1:2.38.1-5+deb12u3
 build-essential=12.9
 bzip2=1.0.8-5+b1
-ca-certificates=20230311+deb12u1
+ca-certificates=20250419~deb12u2
 clang-14=1:14.0.6-12
 clang=1:14.0-55.7~deb12u1
 comerr-dev:amd64=2.1-1.47.0-2+b2
@@ -277,10 +277,10 @@ libpng16-16:amd64=1.6.39-2+deb12u1
 libpq-dev=15.15-0+deb12u1
 libpq5:amd64=15.15-0+deb12u1
 libproc2-0:amd64=2:4.0.2-3
-libprotobuf-dev:amd64=3.21.12-3
-libprotobuf-lite32:amd64=3.21.12-3
-libprotobuf32:amd64=3.21.12-3
-libprotoc32:amd64=3.21.12-3
+libprotobuf-dev:amd64=3.21.12-3+deb12u1
+libprotobuf-lite32:amd64=3.21.12-3+deb12u1
+libprotobuf32:amd64=3.21.12-3+deb12u1
+libprotoc32:amd64=3.21.12-3+deb12u1
 libpsl5:amd64=0.21.2-1
 libpthread-stubs0-dev:amd64=0.4-1
 libpython3-stdlib:amd64=3.11.2-1+b1
@@ -310,8 +310,8 @@ libsqlite3-0:amd64=3.40.1-2+deb12u2
 libsqlite3-dev:amd64=3.40.1-2+deb12u2
 libss2:amd64=1.47.0-2+b2
 libssh2-1:amd64=1.10.0-3+b1
-libssl-dev:amd64=3.0.18-1~deb12u2
-libssl3:amd64=3.0.18-1~deb12u2
+libssl-dev:amd64=3.0.22-1~deb12u1
+libssl3:amd64=3.0.22-1~deb12u1
 libstdc++-12-dev:amd64=12.2.0-14+deb12u1
 libstdc++6:amd64=12.2.0-14+deb12u1
 libsvn1:amd64=1.14.2-4+deb12u1
@@ -390,7 +390,7 @@ ncurses-base=6.4-4
 ncurses-bin=6.4-4
 netbase=6.4
 openssh-client=1:9.2p1-2+deb12u7
-openssl=3.0.18-1~deb12u2
+openssl=3.0.22-1~deb12u1
 passwd=1:4.13+dfsg1-1+deb12u2
 patch=2.7.6-7
 perl-base=5.36.0-7+deb12u3
@@ -401,7 +401,7 @@ pkg-config:amd64=1.8.1-1
 pkgconf-bin=1.8.1-1
 pkgconf:amd64=1.8.1-1
 procps=2:4.0.2-3
-protobuf-compiler=3.21.12-3
+protobuf-compiler=3.21.12-3+deb12u1
 python3-distutils=3.11.2-3
 python3-lib2to3=3.11.2-3
 python3-minimal=3.11.2-1+b1
diff --git a/dstack/verifier/builder/shared/pinned-packages.txt b/dstack/verifier/builder/shared/pinned-packages.txt
index a99c0061b..efd5dfac5 100644
--- a/dstack/verifier/builder/shared/pinned-packages.txt
+++ b/dstack/verifier/builder/shared/pinned-packages.txt
@@ -4,9 +4,9 @@ base-files=12.4+deb12u11
 base-passwd=3.6.1
 bash=5.2.15-2+b8
 bsdutils=1:2.38.1-5+deb12u3
-ca-certificates=20230311+deb12u1
+ca-certificates=20250419~deb12u2
 coreutils=9.1-1
-curl=7.88.1-10+deb12u14
+curl=7.88.1-10+deb12u15
 dash=0.5.12-2
 debconf=1.5.82
 debian-archive-keyring=2023.3+deb12u2
@@ -35,7 +35,7 @@ libcap-ng0:amd64=0.8.3-1+b3
 libcap2:amd64=1:2.66-4+deb12u1
 libcom-err2:amd64=1.47.0-2
 libcrypt1:amd64=1:4.4.33-2
-libcurl4:amd64=7.88.1-10+deb12u14
+libcurl4:amd64=7.88.1-10+deb12u15
 libdb5.3:amd64=5.3.28+dfsg2-1
 libdebconfclient0:amd64=0.270
 libext2fs2:amd64=1.47.0-2
@@ -45,20 +45,20 @@ libgcrypt20:amd64=1.10.1-3
 libgmp10:amd64=2:6.2.1+dfsg1-1.1
 libgnutls30:amd64=3.7.9-2+deb12u4
 libgpg-error0:amd64=1.46-1
-libgssapi-krb5-2:amd64=1.20.1-2+deb12u4
+libgssapi-krb5-2:amd64=1.20.1-2+deb12u5
 libhogweed6:amd64=3.8.1-2
 libidn2-0:amd64=2.3.3-1+b1
-libk5crypto3:amd64=1.20.1-2+deb12u4
+libk5crypto3:amd64=1.20.1-2+deb12u5
 libkeyutils1:amd64=1.6.3-2
-libkrb5-3:amd64=1.20.1-2+deb12u4
-libkrb5support0:amd64=1.20.1-2+deb12u4
+libkrb5-3:amd64=1.20.1-2+deb12u5
+libkrb5support0:amd64=1.20.1-2+deb12u5
 libldap-2.5-0:amd64=2.5.13+dfsg-5
 liblz4-1:amd64=1.9.4-1
 liblzma5:amd64=5.4.1-1
 libmd0:amd64=1.0.4-2
 libmount1:amd64=2.38.1-5+deb12u3
 libnettle8:amd64=3.8.1-2
-libnghttp2-14:amd64=1.52.0-1+deb12u2
+libnghttp2-14:amd64=1.52.0-1+deb12u3
 libp11-kit0:amd64=0.24.1-2
 libpam-modules-bin=1.5.2-6+deb12u1
 libpam-modules:amd64=1.5.2-6+deb12u1
@@ -77,7 +77,7 @@ libsepol2:amd64=3.4-2.1
 libsmartcols1:amd64=2.38.1-5+deb12u3
 libss2:amd64=1.47.0-2
 libssh2-1:amd64=1.10.0-3+b1
-libssl3:amd64=3.0.18-1~deb12u2
+libssl3:amd64=3.0.22-1~deb12u1
 libstdc++6:amd64=12.2.0-14+deb12u1
 libsystemd0:amd64=252.38-1~deb12u1
 libtasn1-6:amd64=4.19.0-2+deb12u1
@@ -93,7 +93,7 @@ mawk=1.3.4.20200120-3.1
 mount=2.38.1-5+deb12u3
 ncurses-base=6.4-4
 ncurses-bin=6.4-4
-openssl=3.0.18-1~deb12u2
+openssl=3.0.22-1~deb12u1
 passwd=1:4.13+dfsg1-1+deb12u1
 perl-base=5.36.0-7+deb12u2
 sed=4.9-1