diff --git a/bazel/toolchains/container_images.bzl b/bazel/toolchains/container_images.bzl
index a8e069966..d4e7cdd79 100644
--- a/bazel/toolchains/container_images.bzl
+++ b/bazel/toolchains/container_images.bzl
@@ -7,7 +7,7 @@ load("@rules_oci//oci:pull.bzl", "oci_pull")
 def containter_image_deps():
     oci_pull(
         name = "distroless_static",
-        digest = "sha256:5c7e2b465ac6a2a4e5f4f7f722ce43b147dabe87cb21ac6c4007ae5178a1fa58",
+        digest = "sha256:3f2b64ef97bd285e36132c684e6b2ae8f2723293d09aae046196cca64251acac",
         image = "gcr.io/distroless/static",
         platforms = [
             "linux/amd64",
diff --git a/bazel/toolchains/nixpkgs_deps.bzl b/bazel/toolchains/nixpkgs_deps.bzl
index d5391d01e..dbebd5d97 100644
--- a/bazel/toolchains/nixpkgs_deps.bzl
+++ b/bazel/toolchains/nixpkgs_deps.bzl
@@ -6,10 +6,10 @@ def nixpkgs_deps():
     http_archive(
         name = "io_tweag_rules_nixpkgs",
         sha256 = "0f7ac344873873d89f8286b4971401dca4a1b249421c2f7c7b56a1befe4501cb",
-        strip_prefix = "rules_nixpkgs-4e169eefd4e9cf38a3569e0b463e93f0c7a3c181",
+        strip_prefix = "rules_nixpkgs-daaf495b92ebd28f1580798235113260fc8ffd72",
         urls = [
             "https://cdn.confidential.cloud/constellation/cas/sha256/0f7ac344873873d89f8286b4971401dca4a1b249421c2f7c7b56a1befe4501cb",
-            "https://github.com/tweag/rules_nixpkgs/archive/4e169eefd4e9cf38a3569e0b463e93f0c7a3c181.tar.gz",
+            "https://github.com/tweag/rules_nixpkgs/archive/daaf495b92ebd28f1580798235113260fc8ffd72.tar.gz",
         ],
         type = "tar.gz",
     )
diff --git a/bazel/toolchains/oci_deps.bzl b/bazel/toolchains/oci_deps.bzl
index 8cfbecf3b..ed694aac3 100644
--- a/bazel/toolchains/oci_deps.bzl
+++ b/bazel/toolchains/oci_deps.bzl
@@ -7,12 +7,12 @@ def oci_deps():
     # Remove this override once https://github.com/bazel-contrib/rules_oci/issues/420 is fixed.
     http_archive(
         name = "rules_oci",
-        strip_prefix = "rules_oci-2.0.1",
+        strip_prefix = "rules_oci-2.2.1",
         type = "tar.gz",
         urls = [
             "https://cdn.confidential.cloud/constellation/cas/sha256/acbf8f40e062f707f8754e914dcb0013803c6e5e3679d3e05b571a9f5c7e0b43",
             "https://cdn.confidential.cloud/constellation/cas/sha256/f70f07f9d0d6c275d7ec7d3c7f236d9b552ba3205e8f37df9c1125031cf967cc",
-            "https://github.com/bazel-contrib/rules_oci/releases/download/v2.0.1/rules_oci-v2.0.1.tar.gz",
+            "https://github.com/bazel-contrib/rules_oci/releases/download/v2.2.1/rules_oci-v2.2.1.tar.gz",
         ],
         sha256 = "acbf8f40e062f707f8754e914dcb0013803c6e5e3679d3e05b571a9f5c7e0b43",
         patches = ["//bazel/toolchains:0001-disable-Windows-support.patch"],