diff --git a/.gitlab-ci/container/build-crosvm.sh b/.gitlab-ci/container/build-crosvm.sh
index 447c7c8f012..1486edf0a28 100644
--- a/.gitlab-ci/container/build-crosvm.sh
+++ b/.gitlab-ci/container/build-crosvm.sh
@@ -25,6 +25,7 @@ cargo update -p pkg-config@0.3.26 --precise 0.3.27
 
 RUSTFLAGS='-L native=/usr/local/lib' cargo install \
   bindgen-cli \
+  --locked \
   -j ${FDO_CI_CONCURRENT:-4} \
   --root /usr/local \
   --version 0.65.1 \
diff --git a/.gitlab-ci/image-tags.yml b/.gitlab-ci/image-tags.yml
index a7fc7c3c137..448f9cd43e7 100644
--- a/.gitlab-ci/image-tags.yml
+++ b/.gitlab-ci/image-tags.yml
@@ -1,6 +1,6 @@
 variables:
    DEBIAN_X86_64_BUILD_BASE_IMAGE: "debian/x86_64_build-base"
-   DEBIAN_BASE_TAG: "2023-07-10-virglrenderer"
+   DEBIAN_BASE_TAG: "2023-08-30-bindgen-cli"
 
    DEBIAN_X86_64_BUILD_IMAGE_PATH: "debian/x86_64_build"
    DEBIAN_BUILD_TAG: "2023-06-24-agility-711"
diff --git a/.pick_status.json b/.pick_status.json
index d8e49074d94..98b77a7617d 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -74,7 +74,7 @@
         "description": "ci: Add locked flag to bindgen-cli installation",
         "nominated": false,
         "nomination_type": 3,
-        "resolution": 4,
+        "resolution": 1,
         "main_sha": null,
         "because_sha": null,
         "notes": null
@@ -30149,4 +30149,4 @@
         "because_sha": null,
         "notes": null
     }
-]
\ No newline at end of file
+]