diff --git a/CHANGELOG.md b/CHANGELOG.md
index 904333d..370b960 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,6 +29,8 @@ since 0.4.1, and this project adheres to [Semantic Versioning](https://semver.or
 
 - The `debian` base image is now fetched by digest. As a result, your local
   container storage will no longer show a tag for this dependency.
+- The `debian` base image is now referenced with a fully qualified URI,
+  including the registry hostname.
 
 ## [0.8.1](https://github.com/freedomofpress/dangerzone/compare/v0.8.1...0.8.0)
 
diff --git a/Dockerfile b/Dockerfile
index f459a42..97a8faa 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,7 +4,7 @@
 
 ARG DEBIAN_IMAGE_DIGEST=sha256:12c396bd585df7ec21d5679bb6a83d4878bc4415ce926c9e5ea6426d23c60bdc
 
-FROM debian@${DEBIAN_IMAGE_DIGEST} AS dangerzone-image
+FROM docker.io/library/debian@${DEBIAN_IMAGE_DIGEST} AS dangerzone-image
 
 ARG GVISOR_ARCHIVE_DATE=20250217
 ARG DEBIAN_ARCHIVE_DATE=20250226
diff --git a/Dockerfile.in b/Dockerfile.in
index bb8f8fc..14f899d 100644
--- a/Dockerfile.in
+++ b/Dockerfile.in
@@ -4,7 +4,7 @@
 
 ARG DEBIAN_IMAGE_DIGEST={{DEBIAN_IMAGE_DIGEST}}
 
-FROM debian@${DEBIAN_IMAGE_DIGEST} AS dangerzone-image
+FROM docker.io/library/debian@${DEBIAN_IMAGE_DIGEST} AS dangerzone-image
 
 ARG GVISOR_ARCHIVE_DATE={{GVISOR_ARCHIVE_DATE}}
 ARG DEBIAN_ARCHIVE_DATE={{DEBIAN_ARCHIVE_DATE}}