diff --git a/os/image/kernel-builder/build.sh b/os/image/kernel-builder/build.sh
index b179f976d..8ed2d20d8 100755
--- a/os/image/kernel-builder/build.sh
+++ b/os/image/kernel-builder/build.sh
@@ -18,7 +18,7 @@ cp "$archive" "$context/kernel-devel.tar.gz"
 
 ${DOCKER:-docker} build \
     --file "$SELF/Dockerfile" \
-    --build-arg "BASE_IMAGE=debian:$DEBIAN_RELEASE-slim" \
+    --build-arg "BASE_IMAGE=$DEBIAN_BASE_IMAGE" \
     --build-arg "DEBIAN_SNAPSHOT=$DEBIAN_SNAPSHOT" \
     --build-arg "KERNEL_RELEASE=$KERNEL_VERSION-dstack" \
     --build-arg "IMAGE_VERSION=${IMAGE_VERSION:-$DSTACK_VERSION}" \
diff --git a/os/mkosi/versions.env b/os/mkosi/versions.env
index 625c382f8..97dfd2844 100644
--- a/os/mkosi/versions.env
+++ b/os/mkosi/versions.env
@@ -4,6 +4,9 @@ KERNEL_VERSION=6.18.40
 KERNEL_SHA256=3712fc1ec839e4daac981176c8518912e8f452650aaedfe4381da4419613a431
 DEBIAN_RELEASE=trixie
 DEBIAN_SNAPSHOT=20260721T000000Z
+# Base of the kernel module builder image. It must predate DEBIAN_SNAPSHOT:
+# apt pinned to the snapshot cannot downgrade packages the base already ships.
+DEBIAN_BASE_IMAGE=debian:trixie-20260713-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd
 MKOSI_VERSION=26
 # mkosi constructs the image, so it is part of the build toolchain and a
 # reproducibility input in its own right. The major version above is what