diff --git a/scripts/image-dast.sh b/scripts/image-dast.sh
index 8d75dcc..dee8e74 100755
--- a/scripts/image-dast.sh
+++ b/scripts/image-dast.sh
@@ -35,7 +35,7 @@
 # The ZAP image is pinned by digest as well as tag. Renovate bumps both.
 set -euo pipefail
 
-zap=ghcr.io/zaproxy/zaproxy:2.17.0@sha256:030d3df57735dacbb83464854758e674dd9ad01d79d12a129a8e58b1fd384238
+zap=ghcr.io/zaproxy/zaproxy:2.17.0@sha256:9624669db72f54d86c4b46a7064518bd9bf79d8c61a4c31befa9923489f328af
 
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$root"