diff --git a/.github/workflows/build-and-publish-docker-image.yml b/.github/workflows/build-and-publish-docker-image.yml
index ab0b6c82..2835757c 100644
--- a/.github/workflows/build-and-publish-docker-image.yml
+++ b/.github/workflows/build-and-publish-docker-image.yml
@@ -77,7 +77,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           annotations: ${{ steps.meta.outputs.annotations }}
           # Runners are ephemeral, so without this every layer is rebuilt on every
-          # run: the pinned Chromium install, the dependency syncs, the driver
+          # run: the Chromium install, the dependency syncs, the driver
           # setup. Scoped per target so the two images do not evict each other. A cache
           # export error (ignore-error defaults to false) should not fail a finished publish.
           cache-from: type=gha,scope=${{ matrix.target }}
diff --git a/Dockerfile b/Dockerfile
index baaf4c1e..3821352a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -148,26 +148,16 @@ ENTRYPOINT ["/usr/bin/dumb-init", "--"]
 
 FROM base AS shelfmark
 
-# --- Chromium (PINNED to 156.0.8078.73) ---
-ARG CHROMIUM_VERSION=156.0.8078.73-1~deb13u1
-ARG CHROMIUM_SNAPSHOT=20261029T020000Z
-
-RUN echo "deb [check-valid-until=no] https://snapshot.debian.org/archive/debian-security/${CHROMIUM_SNAPSHOT}/ trixie-security main" \
-        > /etc/apt/sources.list.d/chromium-pin-snapshot.list && \
-    apt-get update -o Acquire::Retries=5 && \
+# --- Chromium (Debian's current build from trixie-security) ---
+RUN apt-get update -o Acquire::Retries=5 && \
     apt-get install -y --no-install-recommends -o Acquire::Retries=5 \
     # For dumb display
     xvfb \
-    chromium=${CHROMIUM_VERSION} \
-    chromium-common=${CHROMIUM_VERSION} \
+    chromium \
     # For tkinter (pyautogui)
     python3-tk \
     # For RAR extraction
     unrar-free && \
-    # Keep apt from "upgrading" chromium past the pin inside derived images
-    printf 'Package: chromium chromium-common\nPin: version %s\nPin-Priority: 1001\n' "${CHROMIUM_VERSION}" \
-        > /etc/apt/preferences.d/chromium-pin && \
-    rm /etc/apt/sources.list.d/chromium-pin-snapshot.list && \
     # Create symlink so rarfile library can find unrar
     ln -sf /usr/bin/unrar-free /usr/bin/unrar && \
     # Cleanup APT cache