diff --git a/dockerfiles/Dockerfile.hermes-agent b/dockerfiles/Dockerfile.hermes-agent
index 65c1325a..2a2bc207 100644
--- a/dockerfiles/Dockerfile.hermes-agent
+++ b/dockerfiles/Dockerfile.hermes-agent
@@ -22,7 +22,43 @@
 # Kaniko pulls it over the internal insecure registry (see the pipeline's
 # --insecure-registry/--registry-mirror flags) with no docker.io fallback.
 # Re-run that Job whenever this digest is bumped, before publishing the image.
-FROM harbor-core.harbor.svc.cluster.local/mirror/hermes-agent@sha256:9c841866021c54c4596849f6135717e8a4d52ba510b7f52c50aef1de1a283973
+ARG HERMES_AGENT_BASE=harbor-core.harbor.svc.cluster.local/mirror/hermes-agent@sha256:9c841866021c54c4596849f6135717e8a4d52ba510b7f52c50aef1de1a283973
+
+# Python 3.13 dynamically links libsqlite3.so.0, so a checked native library
+# replaces the affected Debian 3.46.1 runtime without rebuilding Python. This
+# target is also an emergency, small multi-arch layer when built with
+# ``--target sqlite-runtime`` and HERMES_AGENT_BASE set to the current agent.
+FROM ${HERMES_AGENT_BASE} AS sqlite-build
+
+USER root
+
+ARG SQLITE_AUTOCONF_VERSION=3510300
+ARG SQLITE_AUTOCONF_SHA256=81f5be397049b0cae1b167f2225af7646fc0f82e4a9b3c48c9ea3a533e21d77a
+ARG SQLITE_AMALGAMATION_SHA3=32d5424f97e0a7fc5ed2f6335afbb58be4e0298bd7117a34e39d345ff13d859e
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends build-essential ca-certificates curl \
+    && curl --fail --location --proto '=https' --tlsv1.2 \
+        --output /tmp/sqlite.tar.gz \
+        "https://www.sqlite.org/2026/sqlite-autoconf-${SQLITE_AUTOCONF_VERSION}.tar.gz" \
+    && echo "${SQLITE_AUTOCONF_SHA256}  /tmp/sqlite.tar.gz" | sha256sum --check --status \
+    && tar -xzf /tmp/sqlite.tar.gz -C /tmp \
+    && /opt/hermes/.venv/bin/python -c 'import hashlib, pathlib, sys; expected=sys.argv[1]; actual=hashlib.sha3_256(pathlib.Path(sys.argv[2]).read_bytes()).hexdigest(); raise SystemExit(actual != expected)' "${SQLITE_AMALGAMATION_SHA3}" "/tmp/sqlite-autoconf-${SQLITE_AUTOCONF_VERSION}/sqlite3.c" \
+    && cd "/tmp/sqlite-autoconf-${SQLITE_AUTOCONF_VERSION}" \
+    && ./configure --prefix=/opt/sqlite --disable-static \
+    && make -j"$(nproc)" \
+    && make install-strip \
+    && test -L /opt/sqlite/lib/libsqlite3.so.0 \
+    && /opt/sqlite/bin/sqlite3 ':memory:' 'select sqlite_version();' | grep -Fx '3.51.3'
+
+FROM ${HERMES_AGENT_BASE} AS sqlite-runtime
+
+USER root
+
+COPY --from=sqlite-build /opt/sqlite/lib/ /usr/local/lib/
+RUN ldconfig \
+    && /opt/hermes/.venv/bin/python -c 'import sqlite3; assert sqlite3.sqlite_version_info >= (3, 51, 3), sqlite3.sqlite_version'
+
+FROM sqlite-runtime
 
 USER root