diff --git a/MODULE.bazel b/MODULE.bazel
index 6e0e371ab95a0..a5237638b6dd9 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -107,7 +107,7 @@ register_toolchains("@dotnet_toolchains//:all")
 oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
 oci.pull(
     name = "java_image_base",
-    digest = "sha256:1df9f3e6a2de0544dd04f1840aa811d334045c9126f9e93d8da45448061ad51e",
+    digest = "sha256:4d41893f2e35d2d1a3a14fea495798b86c39b028b7f341f7f5a6edaa07fcaf46",
     image = "gcr.io/distroless/java17",
 )
 oci.pull(
diff --git a/py/requirements_lock.txt b/py/requirements_lock.txt
index c9398b21213d9..e2534d3ec56e4 100644
--- a/py/requirements_lock.txt
+++ b/py/requirements_lock.txt
@@ -364,6 +364,7 @@ jeepney==0.9.0 \
     --hash=sha256:cf0e9e845622b81e4a28df94c40345400256ec608d0e55bb8a3feaa9163f5732
     # via
     #   -r py/requirements.txt
+    #   keyring
     #   secretstorage
 keyring==25.6.0 \
     --hash=sha256:0b39998aa941431eb3d9b0d4b2460bc773b9df6fed7621c2dfb291a7e0187a66 \
@@ -651,7 +652,9 @@ rich==14.0.0 \
 secretstorage==3.3.3 \
     --hash=sha256:2403533ef369eca6d2ba81718576c5e0f564d5cca1b58f73a8b23e7d4eeebd77 \
     --hash=sha256:f356e6628222568e3af06f2eba8df495efa13b3b63081dafd4f7d9a7b7bc9f99
-    # via -r py/requirements.txt
+    # via
+    #   -r py/requirements.txt
+    #   keyring
 sniffio==1.3.1 \
     --hash=sha256:2f6da418d1f1e0fddd844478f41680e794e6051915791a034ff65e5f100525a2 \
     --hash=sha256:f4324edc670a0f49750a81b895f35c3adb843cca46f0530f79fc1babb23789dc