diff --git a/CHANGELOG.md b/CHANGELOG.md
index da1cfaf45..6c5787f6b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,8 @@
 
 ## Unreleased: mitmproxy next
 
+- Docker: Update image to Python 3.13 on Debian Bookworm.
+  ([#7242](https://github.com/mitmproxy/mitmproxy/pull/7242), @mhils)
 - Tighten HTTP detection heuristic to better support custom TCP-based protocols.
   ([#7228](https://github.com/mitmproxy/mitmproxy/pull/7228), @fatanugraha)
 
diff --git a/release/docker/Dockerfile b/release/docker/Dockerfile
index 7ed4350d8..4dd003d17 100644
--- a/release/docker/Dockerfile
+++ b/release/docker/Dockerfile
@@ -1,9 +1,9 @@
-FROM python:3.11-bullseye AS wheelbuilder
+FROM python:3.13-bookworm AS wheelbuilder
 
 COPY mitmproxy-*-py3-none-any.whl /wheels/
 RUN pip install wheel && pip wheel --wheel-dir /wheels /wheels/*.whl
 
-FROM python:3.11-slim-bullseye
+FROM python:3.13-slim-bookworm
 
 RUN useradd -mU mitmproxy
 RUN apt-get update \
diff --git a/release/docker/docker-entrypoint.sh b/release/docker/docker-entrypoint.sh
index 8a38c93ec..676ff5e37 100755
--- a/release/docker/docker-entrypoint.sh
+++ b/release/docker/docker-entrypoint.sh
@@ -15,7 +15,8 @@ fi
 usermod -o \
     -u $(stat -c "%u" "$f") \
     -g $(stat -c "%g" "$f") \
-    mitmproxy
+    mitmproxy \
+    >/dev/null  # hide "usermod: no changes"
 
 if [[ "$1" = "mitmdump" || "$1" = "mitmproxy" || "$1" = "mitmweb" ]]; then
   exec gosu mitmproxy "$@"