diff --git a/Cargo.lock b/Cargo.lock
index 5a4706f..64886f8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2609,7 +2609,7 @@ dependencies = [
 
 [[package]]
 name = "webterm"
-version = "0.3.8"
+version = "0.3.10"
 dependencies = [
  "actix",
  "actix-files",
diff --git a/Cargo.toml b/Cargo.toml
index 0067c2b..6a95f08 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -6,7 +6,7 @@ documentation = "https://docs.rs/webterm"
 readme = "README.md"
 categories = ["web-programming", "web-programming::websocket", "web-programming::http-server", "command-line-utilities"]
 keywords = ["terminal", "xterm", "websocket", "terminus", "console"]
-version = "0.3.9"
+version = "0.3.10"
 authors = ["fabian.freyer@physik.tu-berlin.de","jasonpwitty+socktop@proton.me"]
 edition = "2021"
 license = "BSD-3-Clause"
diff --git a/Dockerfile b/Dockerfile
index 2d6f306..29f1e27 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -121,12 +121,17 @@ RUN apt-get update && \
     curl \
     && rm -rf /var/lib/apt/lists/*
 
-# Add socktop APT repository and install packages
+# Add socktop APT repository and install packages.
+# The version is pinned: the restricted shell passes flags that must exist in
+# the installed binary (e.g. --no-kill), and CI's registry layer cache would
+# otherwise happily reuse an apt layer from before a socktop release. Bump the
+# pin together with any restricted-shell.sh change that uses a new flag.
+ARG SOCKTOP_VERSION=1.60.2-1
 RUN curl -fsSL https://jasonwitty.github.io/socktop/KEY.gpg | \
     gpg --dearmor -o /usr/share/keyrings/socktop-archive-keyring.gpg && \
     echo "deb [signed-by=/usr/share/keyrings/socktop-archive-keyring.gpg] https://jasonwitty.github.io/socktop stable main" > /etc/apt/sources.list.d/socktop.list && \
     apt-get update && \
-    apt-get install -y --no-install-recommends socktop socktop-agent && \
+    apt-get install -y --no-install-recommends socktop=${SOCKTOP_VERSION} socktop-agent=${SOCKTOP_VERSION} && \
     rm -rf /var/lib/apt/lists/*
 
 # Create application user (if not already exists from socktop packages)
diff --git a/kubernetes/03-deployment.yaml b/kubernetes/03-deployment.yaml
index dc0e61a..f416fa8 100644
--- a/kubernetes/03-deployment.yaml
+++ b/kubernetes/03-deployment.yaml
@@ -85,7 +85,7 @@ spec:
 
       containers:
         - name: webterm
-          image: gt.wittyoneoff.com/jason/socktop-webterm:0.2.2
+          image: gt.wittyoneoff.com/jason/socktop-webterm:0.3.10
           imagePullPolicy: Always
 
           command: ["/docker-entrypoint.sh"]