diff --git a/.github/workflows/helm-ci.yml b/.github/workflows/helm-ci.yml
index 0cc952ec532..14b0fd43408 100644
--- a/.github/workflows/helm-ci.yml
+++ b/.github/workflows/helm-ci.yml
@@ -16,7 +16,7 @@ jobs:
     with:
       ct_configfile: operations/helm/ct.yaml
       ct_check_version_increment: false
-      helm_version: v4.0.1
+      helm_version: v4.0.4
       kind_kubectl_version: v1.29.5
       kind_node_image: kindest/node:v1.29.0
 
diff --git a/Makefile b/Makefile
index 4ca90a9a513..ccbfc8277dd 100644
--- a/Makefile
+++ b/Makefile
@@ -224,7 +224,7 @@ mimir-build-image/$(UPTODATE): mimir-build-image/*
 # All the boiler plate for building golang follows:
 SUDO := $(shell docker info >/dev/null 2>&1 || echo "sudo -E")
 BUILD_IN_CONTAINER ?= true
-LATEST_BUILD_IMAGE_TAG ?= pr13755-74bc46444f
+LATEST_BUILD_IMAGE_TAG ?= pr13952-5e5dcac988
 
 # TTY is parameterized to allow CI and scripts to run builds,
 # as it currently disallows TTY devices.
diff --git a/mimir-build-image/Dockerfile b/mimir-build-image/Dockerfile
index 9d08df824d6..848d6001549 100644
--- a/mimir-build-image/Dockerfile
+++ b/mimir-build-image/Dockerfile
@@ -4,7 +4,7 @@
 # Provenance-includes-copyright: The Cortex Authors.
 
 FROM registry.k8s.io/kustomize/kustomize:v5.4.3 AS kustomize
-FROM alpine/helm:4.0.1 AS helm
+FROM alpine/helm:4.0.4@sha256:adb87b125214fd356ecc1a24a1e86e4afed0ee03de5d4391de4925777de7fd42 AS helm
 FROM golang:1.25.5-trixie@sha256:4f9d98ebaa759f776496d850e0439c48948d587b191fc3949b5f5e4667abef90
 ARG goproxyValue
 ENV GOPROXY=${goproxyValue}