diff --git a/.github/workflows/skills-keyless-signing-e2e.yml b/.github/workflows/skills-keyless-signing-e2e.yml
index 9359d88791..c05a11183f 100644
--- a/.github/workflows/skills-keyless-signing-e2e.yml
+++ b/.github/workflows/skills-keyless-signing-e2e.yml
@@ -64,7 +64,7 @@ jobs:
       # Throwaway registry. Nothing published here outlives the job, so it
       # runs over plain HTTP with no auth.
       registry:
-        image: registry:3@sha256:852b3e4d378c426dda6b318fe9d9bfe8e92a0eccb9926671ec3d3ea17a196696
+        image: registry:3@sha256:ddf754342cfc8acc51a56d5d0ab6af06826461864460636d8bd5c546dab2a7b8
         ports:
           - 5000:5000
 
diff --git a/cmd/thv/app/inspector/version.go b/cmd/thv/app/inspector/version.go
index 5ccacde8dd..405331bfbd 100644
--- a/cmd/thv/app/inspector/version.go
+++ b/cmd/thv/app/inspector/version.go
@@ -7,4 +7,4 @@ package inspector
 // Image specifies the image to use for the inspector command.
 // TODO: This could probably be a flag with a sensible default
 // Pinning to a specific version for stability.
-var Image = "ghcr.io/modelcontextprotocol/inspector:2.8.0"
+var Image = "ghcr.io/modelcontextprotocol/inspector:2.9.0"