diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 2fe746831..50bcd9836 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -16,7 +16,7 @@ stages:
 
 ci image:
   stage: prepare
-  image: registry.ddbuild.io/images/docker:20.10
+  image: registry.ddbuild.io/images/docker:27.3.1@sha256:966b6cd18c53e3730e7aaea2c0ca6b6b9877dcff11d9446f25ee5bc2293585d0
   tags: ["arch:arm64"]
   rules:
     - if: '$CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "push"'
diff --git a/.gitlab/Dockerfile b/.gitlab/Dockerfile
index 3daa4a5fb..bd30f6e7b 100644
--- a/.gitlab/Dockerfile
+++ b/.gitlab/Dockerfile
@@ -26,3 +26,27 @@ ENV PATH=$PATH:/root/.cargo/bin/
 ENV LIBCLANG_PATH=/usr/lib/x86_64-linux-gnu
 
 RUN rustup component add rust-src --toolchain stable
+
+# Pin the internal client independently of the parent image's Docker packages.
+ARG BUILDX_VERSION=0.38.1-dd.1
+ARG BUILDX_SHA256_amd64=3a7b0c660da5bdb9df799d5ce339bdfceeafc98b2fa7f56cf2cccbca4691a112
+ARG BUILDX_SHA256_arm64=9d47a29f85bfa7b4998a4969bcb8c51102ecea1f1db19217df7b2b68977e029a
+RUN set -eu; \
+    buildx_arch="$(dpkg --print-architecture)"; \
+    case "$buildx_arch" in \
+      amd64) buildx_sha256="$BUILDX_SHA256_amd64" ;; \
+      arm64) buildx_sha256="$BUILDX_SHA256_arm64" ;; \
+      *) echo "Unsupported Buildx architecture: $buildx_arch" >&2; exit 1 ;; \
+    esac; \
+    buildx_tmp="$(mktemp -d)"; \
+    trap 'rm -rf "$buildx_tmp"' EXIT; \
+    curl -fsSL -o "$buildx_tmp/buildx.tar.gz" \
+      "https://depot-read-api-github-releases.us1.ddbuild.io/internal/mirror/github-releases/DataDog/buildx/releases/download/v${BUILDX_VERSION}/buildx_${BUILDX_VERSION}_linux_${buildx_arch}.tar.gz"; \
+    printf '%s  %s\n' "$buildx_sha256" "$buildx_tmp/buildx.tar.gz" | sha256sum -c -; \
+    tar -xzf "$buildx_tmp/buildx.tar.gz" -C "$buildx_tmp" buildx; \
+    install -D -m 0755 "$buildx_tmp/buildx" /usr/local/libexec/docker/cli-plugins/docker-buildx; \
+    buildx_selected="$(docker buildx version)"; \
+    case "$buildx_selected" in \
+      "github.com/docker/buildx v${BUILDX_VERSION} "*) printf '%s\n' "$buildx_selected" ;; \
+      *) echo "Unexpected Buildx client: $buildx_selected" >&2; exit 1 ;; \
+    esac
diff --git a/.gitlab/templates/pipeline.yaml.tpl b/.gitlab/templates/pipeline.yaml.tpl
index 9bdcddb76..db89d1069 100644
--- a/.gitlab/templates/pipeline.yaml.tpl
+++ b/.gitlab/templates/pipeline.yaml.tpl
@@ -71,7 +71,7 @@ cargo clippy:
 
 bottlecap ({{ $flavor.name }}):
   stage: compile
-  image: registry.ddbuild.io/images/docker:20.10
+  image: registry.ddbuild.io/images/docker:27.3.1@sha256:966b6cd18c53e3730e7aaea2c0ca6b6b9877dcff11d9446f25ee5bc2293585d0
   tags: ["arch:{{ $flavor.arch }}"]
   needs: []
   # This job sometimes times out on GitLab for unclear reasons.
@@ -97,7 +97,7 @@ bottlecap ({{ $flavor.name }}):
 
 layer ({{ $flavor.name }}):
   stage: build
-  image: registry.ddbuild.io/images/docker:20.10
+  image: registry.ddbuild.io/images/docker:27.3.1@sha256:966b6cd18c53e3730e7aaea2c0ca6b6b9877dcff11d9446f25ee5bc2293585d0
   tags: ["arch:{{ $flavor.arch }}"]
   needs:
     - bottlecap ({{ $flavor.name }})
@@ -121,7 +121,7 @@ layer ({{ $flavor.name }}):
 
 check layer size ({{ $flavor.name }}):
   stage: build
-  image: registry.ddbuild.io/images/docker:20.10
+  image: registry.ddbuild.io/images/docker:27.3.1@sha256:966b6cd18c53e3730e7aaea2c0ca6b6b9877dcff11d9446f25ee5bc2293585d0
   tags: ["arch:amd64"]
   needs:
     - layer ({{ $flavor.name }})
@@ -325,7 +325,7 @@ e2e-test ({{ $f.name }}):
 
 e2e-test-status ({{ $f.name }}):
   stage: e2e
-  image: registry.ddbuild.io/images/docker:20.10-py3
+  image: registry.ddbuild.io/images/docker:27.3.1@sha256:966b6cd18c53e3730e7aaea2c0ca6b6b9877dcff11d9446f25ee5bc2293585d0
   tags: ["arch:amd64"]
   timeout: 3h
   variables:
@@ -367,7 +367,7 @@ publish private images ({{ $multi_arch_image_flavor.name }}):
 image ({{ $multi_arch_image_flavor.name }}):
   stage: build
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:20.10
+  image: registry.ddbuild.io/images/docker:27.3.1@sha256:966b6cd18c53e3730e7aaea2c0ca6b6b9877dcff11d9446f25ee5bc2293585d0
   rules:
     - if: '$CI_COMMIT_TAG =~ /^v.*/'
   needs:
@@ -400,7 +400,7 @@ publish image ({{ $multi_arch_image_flavor.name }}):
 
 layer bundle:
   stage: build
-  image: registry.ddbuild.io/images/docker:20.10
+  image: registry.ddbuild.io/images/docker:27.3.1@sha256:966b6cd18c53e3730e7aaea2c0ca6b6b9877dcff11d9446f25ee5bc2293585d0
   tags: ["arch:amd64"]
   needs:
     {{ range (ds "flavors").flavors }}
@@ -422,7 +422,7 @@ layer bundle:
 
 signed layer bundle:
   stage: sign
-  image: registry.ddbuild.io/images/docker:20.10
+  image: registry.ddbuild.io/images/docker:27.3.1@sha256:966b6cd18c53e3730e7aaea2c0ca6b6b9877dcff11d9446f25ee5bc2293585d0
   tags: ["arch:amd64"]
   rules:
     - if: '$CI_COMMIT_TAG =~ /^v.*/'