diff --git a/Dockerfile b/Dockerfile
index fcd5c43..e4aa533 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,16 +1,17 @@
 # Pin the base image to a specific hash for maximum reproducibility.
 # It will probably still work on newer images, though, unless an update
 # changes some compiler optimisations (unlikely).
+# fedora-35-ocaml-4.14
 FROM ocaml/opam@sha256:68b7ce1fd4c992d6f3bfc9b4b0a88ee572ced52427f0547b6e4eb6194415f585
 ENV PATH="${PATH}:/home/opam/.opam/4.14/bin"
 
 # Since mirage 4.2 we must use opam version 2.1 or later
-RUN sudo cp /usr/bin/opam-2.1 /usr/bin/opam
+RUN sudo ln -sf /usr/bin/opam-2.1 /usr/bin/opam
 
 # Pin last known-good version for reproducible builds.
 # Remove this line (and the base image pin above) if you want to test with the
 # latest versions.
-RUN cd /home/opam/opam-repository && git fetch origin master && git reset --hard f85e121f6dd1fd92d9a3d9c8ac9fa553495258bc && opam update
+RUN cd /home/opam/opam-repository && git fetch origin master && git reset --hard f904585098b809001380caada4b7426c112d086c && opam update
 
 RUN opam install -y mirage opam-monorepo
 RUN mkdir /home/opam/qubes-mirage-firewall