diff --git a/ci/refreeze b/ci/refreeze
index 91ae4fd4ab..a1244b0814 100755
--- a/ci/refreeze
+++ b/ci/refreeze
@@ -13,7 +13,7 @@ for img in ${IMAGES}; do
         --volume="$PWD:/io" \
         --workdir=/io \
         --user=root \
-        python:3.11-bookworm \
+        python:3.12-bookworm \
         sh -c 'pip install pip-tools==7.* && pip-compile --allow-unsafe --strip-extras --upgrade'
     popd
 done
diff --git a/images/hub/Dockerfile b/images/hub/Dockerfile
index 286c014163..6e8142d5d7 100644
--- a/images/hub/Dockerfile
+++ b/images/hub/Dockerfile
@@ -10,7 +10,7 @@
 # NOTE: If the image version is updated, also update it in ci/refreeze and
 #       singleuser-sample's Dockerfile!
 #
-FROM python:3.11-bookworm as build-stage
+FROM python:3.12-bookworm as build-stage
 
 # Build wheels
 #
@@ -38,7 +38,7 @@ RUN --mount=type=cache,target=${PIP_CACHE_DIR} \
 # This stage is built and published as quay.io/jupyterhub/k8s-hub-slim. It is meant to
 # provide no non-essential packages.
 #
-FROM python:3.11-slim-bookworm as slim-stage
+FROM python:3.12-slim-bookworm as slim-stage
 ENV DEBIAN_FRONTEND=noninteractive
 
 ARG NB_USER=jovyan \
diff --git a/images/secret-sync/Dockerfile b/images/secret-sync/Dockerfile
index eb72198b0b..d5345b8383 100644
--- a/images/secret-sync/Dockerfile
+++ b/images/secret-sync/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.11-alpine
+FROM python:3.12-alpine
 
 # VULN_SCAN_TIME=2024-09-09_05:05:19
 
diff --git a/images/singleuser-sample/Dockerfile b/images/singleuser-sample/Dockerfile
index 17d446f25a..55a71c3d07 100644
--- a/images/singleuser-sample/Dockerfile
+++ b/images/singleuser-sample/Dockerfile
@@ -10,7 +10,7 @@
 # NOTE: If the image version is updated, also update it in ci/refreeze and
 #       hub's Dockerfile!
 #
-FROM python:3.11-bookworm as build-stage
+FROM python:3.12-bookworm as build-stage
 
 # Build wheels
 #
@@ -30,7 +30,7 @@ RUN --mount=type=cache,target=${PIP_CACHE_DIR} \
 # The final stage
 # ---------------
 #
-FROM python:3.11-slim-bookworm
+FROM python:3.12-slim-bookworm
 ENV DEBIAN_FRONTEND=noninteractive
 
 ENV NB_USER=jovyan \