diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 2047ab5..04afb5e 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -18,7 +18,7 @@ Use the update script with a stable upstream release version:
 <!-- tiny-cli-images:version:age:start -->
 
 ```sh
-python3 scripts/update.py age 1.3.1
+python3 scripts/update.py age 1.3.2
 ```
 
 <!-- tiny-cli-images:version:age:end -->
diff --git a/README.md b/README.md
index 55ddcad..682c536 100644
--- a/README.md
+++ b/README.md
@@ -33,7 +33,7 @@ in a minimal, non-root container without a shell or package manager.
 <!-- tiny-cli-images:version:age:start -->
 
 ```sh
-docker run --rm ghcr.io/unitmatrix/age:1.3.1-r1 --version
+docker run --rm ghcr.io/unitmatrix/age:1.3.2 --version
 ```
 
 <!-- tiny-cli-images:version:age:end -->
diff --git a/docs/PROJECT.md b/docs/PROJECT.md
index b27797f..4bd238a 100644
--- a/docs/PROJECT.md
+++ b/docs/PROJECT.md
@@ -164,7 +164,7 @@ creates the corresponding release tag. For example:
 
 <!-- tiny-cli-images:version:age:start -->
 
-`Update age to 1.3.1` creates `age/v1.3.1`.
+`Update age to 1.3.2` creates `age/v1.3.2`.
 
 <!-- tiny-cli-images:version:age:end -->
 
diff --git a/images/age/README.md b/images/age/README.md
index 3f2caa3..be8261c 100644
--- a/images/age/README.md
+++ b/images/age/README.md
@@ -13,7 +13,7 @@ Encrypt a file for a recipient:
 
 ```sh
 docker run --rm --interactive \
-  ghcr.io/unitmatrix/age:1.3.1-r1 \
+  ghcr.io/unitmatrix/age:1.3.2 \
   --encrypt \
   --recipient age1... \
   < document.txt \
@@ -25,7 +25,7 @@ Decrypt with an identity mounted under `/work`:
 ```sh
 docker run --rm --interactive \
   --volume "$PWD:/work:ro" \
-  ghcr.io/unitmatrix/age:1.3.1-r1 \
+  ghcr.io/unitmatrix/age:1.3.2 \
   --decrypt \
   --identity /work/key.txt \
   < document.txt.age
@@ -38,7 +38,7 @@ binaries are also available at the filesystem root. For example:
 ```sh
 docker run --rm \
   --entrypoint /age-keygen \
-  ghcr.io/unitmatrix/age:1.3.1-r1
+  ghcr.io/unitmatrix/age:1.3.2
 ```
 
 ## Platforms
@@ -48,7 +48,7 @@ docker run --rm \
 
 ## Pinning
 
-An upstream release publishes its full version tag, such as `1.3.1`.
+An upstream release publishes its full version tag, such as `1.3.2`.
 
 <!-- tiny-cli-images:version:age:end -->
 
diff --git a/images/age/image.toml b/images/age/image.toml
index a0b17c7..cce9222 100644
--- a/images/age/image.toml
+++ b/images/age/image.toml
@@ -1,6 +1,6 @@
 name = "age"
 description = "Minimal, multi-architecture OCI container image for age file encryption"
-version = "1.3.1"
+version = "1.3.2"
 
 upstream = "FiloSottile/age"
 license = "BSD-3-Clause"
@@ -9,8 +9,8 @@ architectures = ["amd64", "arm64"]
 
 [platform.amd64]
 target = "linux-amd64"
-sha256 = "bdc69c09cbdd6cf8b1f333d372a1f58247b3a33146406333e30c0f26e8f51377"
+sha256 = "cbe24006683f8eb669266162894b9a522a1af52f2665fbc63a4bb032ed26ac10"
 
 [platform.arm64]
 target = "linux-arm64"
-sha256 = "c6878a324421b69e3e20b00ba17c04bc5c6dab0030cfe55bf8f68fa8d9e9093a"
+sha256 = "6b8dc4333c53a5a57c9e5834e3a48f92605d7154014cd07269ff3327db5d37f4"