diff --git a/package-lock.json b/package-lock.json
index d44b27fd..41a7aabe 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -485,9 +485,9 @@
       }
     },
     "@vercel/ncc": {
-      "version": "0.28.5",
-      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.28.5.tgz",
-      "integrity": "sha512-ZSwD4EDCon2EsnPZ2/Qcigx4N2DiuBLV/rDnF04giEPFuDeBeUDdnSTyYYfX8KNic/prrJuS1vUEmAOHmj+fRg==",
+      "version": "0.28.6",
+      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.28.6.tgz",
+      "integrity": "sha512-t4BoSSuyK8BZaUE0gV18V6bkFs4st7baumtFGa50dv1tMu2GDBEBF8sUZaKBdKiL6DzJ2D2+XVCwYWWDcQOYdQ==",
       "dev": true
     },
     "JSONStream": {
diff --git a/package.json b/package.json
index 6f69f952..d7cdd0a8 100644
--- a/package.json
+++ b/package.json
@@ -40,7 +40,7 @@
     "@types/node": "13.13.52",
     "@typescript-eslint/eslint-plugin": "4.25.0",
     "@typescript-eslint/parser": "4.25.0",
-    "@vercel/ncc": "0.28.5",
+    "@vercel/ncc": "0.28.6",
     "concurrently": "6.2.0",
     "eslint": "7.27.0",
     "eslint-config-prettier": "8.3.0",
diff --git a/src/docker.ts b/src/docker.ts
index ead8b9e2..4bb4cede 100644
--- a/src/docker.ts
+++ b/src/docker.ts
@@ -1,7 +1,7 @@
 class Docker {
   readonly repository = 'renovate/renovate';
   // renovate: datasource=docker depName=renovate/renovate versioning=docker
-  readonly tag = '25.35.2-slim';
+  readonly tag = '25.35.4-slim';
   readonly tagSuffix = '-slim';
 
   image(): string {