diff --git a/CHANGELOG.md b/CHANGELOG.md
index f9f5d64..de426ab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.31.3
+
+* Upgrade to Nginx 1.31.3.
+* Switch from Debian Bookworm to Trixie, picking up the patched OpenSSL
+  for CVE-2025-69419.
+
 ## 1.27.4
 
 * Upgrade to Nginx 1.27.4.
diff --git a/Dockerfile b/Dockerfile
index ed5cef2..9848f5e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM nginx:1.27.4-bookworm
+FROM nginx:1.31.3-trixie
 
 ENV NGINX_ENTRYPOINT_QUIET_LOGS=1