diff --git a/lib/config/options/index.ts b/lib/config/options/index.ts
index 7f4a0976bbc..0eb687af88a 100644
--- a/lib/config/options/index.ts
+++ b/lib/config/options/index.ts
@@ -649,7 +649,7 @@ const options: Readonly<RenovateOptions>[] = [
     description:
       'Change this value to override the default Renovate sidecar image.',
     type: 'string',
-    default: 'ghcr.io/renovatebot/base-image:13.23.1',
+    default: 'ghcr.io/renovatebot/base-image:13.25.0',
     globalOnly: true,
     deprecationMsg:
       'The usage of `binarySource=docker` is deprecated, and will be removed in the future',
diff --git a/package.json b/package.json
index 11d424dec2b..65b7212e71f 100644
--- a/package.json
+++ b/package.json
@@ -150,7 +150,7 @@
   },
   "volta": {
     "node": "24.14.0",
-    "pnpm": "10.30.3"
+    "pnpm": "10.31.0"
   },
   "dependencies": {
     "@aws-sdk/client-codecommit": "3.1000.0",
@@ -362,7 +362,7 @@
     "vitest": "4.0.18",
     "vitest-mock-extended": "3.1.0"
   },
-  "packageManager": "pnpm@10.30.3",
+  "packageManager": "pnpm@10.31.0",
   "files": [
     "dist",
     "renovate-schema.json"
diff --git a/tools/docker/Dockerfile b/tools/docker/Dockerfile
index 3103a79f986..c73de312914 100644
--- a/tools/docker/Dockerfile
+++ b/tools/docker/Dockerfile
@@ -5,19 +5,19 @@ ARG BASE_IMAGE_TYPE=slim
 # --------------------------------------
 # slim image
 # --------------------------------------
-FROM ghcr.io/renovatebot/base-image:13.23.1@sha256:c966118d8cf0caa2d57d1b03a7d76f67bfabc2af51c42a8ad2643c7a620679a8 AS slim-base
+FROM ghcr.io/renovatebot/base-image:13.25.0@sha256:d8886ac62dff20f8205affdc85a8244017353b107a3682b7c739f8869a8050a4 AS slim-base
 
 # --------------------------------------
 # full image
 # --------------------------------------
-FROM ghcr.io/renovatebot/base-image:13.23.1-full@sha256:9a36e32c31f071e4ada2753954f2b5eb465d05f2bc156404dbb602ca56713955 AS full-base
+FROM ghcr.io/renovatebot/base-image:13.25.0-full@sha256:cdc66b269a3f3900355eb854424c63566e222d60ee5f2a23d915aa599bd34f89 AS full-base
 
 ENV RENOVATE_BINARY_SOURCE=global
 
 # --------------------------------------
 # build image
 # --------------------------------------
-FROM --platform=$BUILDPLATFORM ghcr.io/renovatebot/base-image:13.23.1@sha256:c966118d8cf0caa2d57d1b03a7d76f67bfabc2af51c42a8ad2643c7a620679a8 AS build
+FROM --platform=$BUILDPLATFORM ghcr.io/renovatebot/base-image:13.25.0@sha256:d8886ac62dff20f8205affdc85a8244017353b107a3682b7c739f8869a8050a4 AS build
 
 # We want a specific node version here
 # renovate: datasource=github-releases packageName=containerbase/node-prebuild versioning=node
@@ -25,7 +25,7 @@ RUN install-tool node 24.14.0
 
 # corepack is too buggy 😞
 # renovate: datasource=npm
-RUN install-tool pnpm 10.30.3
+RUN install-tool pnpm 10.31.0
 
 WORKDIR /usr/local/renovate