diff --git a/Dockerfile b/Dockerfile
index 8da51b1..00bb72a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,14 +1,14 @@
 # syntax=docker/dockerfile:1
 
-FROM haskell:9.8.2-buster AS build
+FROM haskell:9.8.4-bullseye AS build
 RUN git clone https://github.com/haskell-actions/hlint-scan.git /src/hlint-scan
 WORKDIR /src/hlint-scan
 RUN stack install hlint hlint-scan:exe:hlint-scan && \
     cp "$(stack path --local-bin)/hlint" "$(stack path --local-bin)/hlint-scan" /
 
-FROM debian:buster-slim
+FROM debian:bullseye-slim
 RUN apt-get --yes update && \
-    apt-get --yes --no-install-recommends install ca-certificates=20200601~deb10u2 && \
+    apt-get --yes --no-install-recommends install ca-certificates=20210119 && \
     apt-get --yes clean && \
     rm -rf /var/lib/apt/lists/*
 COPY --from=build /hlint /hlint-scan /
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 15944fc..922e704 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -10,6 +10,8 @@ the [Haskell Package Versioning Policy].
 
 ## Unreleased
 
+*   Update to `bullseye` Debian Docker image and GHC 9.8.4.
+
 ## 1.3.0 - 2025-02-06
 
 *   Add ability to disable code scanning and output annotations.
diff --git a/stack.yaml b/stack.yaml
index a5b15ad..899ac13 100644
--- a/stack.yaml
+++ b/stack.yaml
@@ -17,7 +17,7 @@
 # https://docs.haskellstack.org/en/stable/yaml_configuration/
 
 # Resolver to choose a 'specific' stackage snapshot or a compiler version.
-resolver: nightly-2024-10-21
+resolver: lts-23.7
 
 # User packages to be built.
 packages: