diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 440d228..2047ab5 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -18,7 +18,7 @@ Use the update script with a stable upstream release version:
 <!-- tiny-cli-images:version:age:start -->
 
 ```sh
-python3 scripts/update.py age 1.3.0
+python3 scripts/update.py age 1.3.1
 ```
 
 <!-- tiny-cli-images:version:age:end -->
diff --git a/README.md b/README.md
index 9206260..e055578 100644
--- a/README.md
+++ b/README.md
@@ -27,7 +27,7 @@ Minimal OCI images for useful command-line tools.
 <!-- tiny-cli-images:version:age:start -->
 
 ```sh
-docker run --rm ghcr.io/unitmatrix/age:1.3.0 --version
+docker run --rm ghcr.io/unitmatrix/age:1.3.1 --version
 ```
 
 <!-- tiny-cli-images:version:age:end -->
diff --git a/images/age/README.md b/images/age/README.md
index cdfb456..ab38a1b 100644
--- a/images/age/README.md
+++ b/images/age/README.md
@@ -11,7 +11,7 @@ Encrypt a file for a recipient:
 
 ```sh
 docker run --rm --interactive \
-  ghcr.io/unitmatrix/age:1.3.0 \
+  ghcr.io/unitmatrix/age:1.3.1 \
   --encrypt \
   --recipient age1... \
   < document.txt \
@@ -23,7 +23,7 @@ Decrypt with an identity mounted under `/work`:
 ```sh
 docker run --rm --interactive \
   --volume "$PWD:/work:ro" \
-  ghcr.io/unitmatrix/age:1.3.0 \
+  ghcr.io/unitmatrix/age:1.3.1 \
   --decrypt \
   --identity /work/key.txt \
   < document.txt.age
@@ -36,7 +36,7 @@ binaries are also available at the filesystem root. For example:
 ```sh
 docker run --rm \
   --entrypoint /age-keygen \
-  ghcr.io/unitmatrix/age:1.3.0
+  ghcr.io/unitmatrix/age:1.3.1
 ```
 
 ## Platforms
@@ -46,7 +46,7 @@ docker run --rm \
 
 ## Pinning
 
-Each release publishes only its full upstream version tag, such as `1.3.0`.
+Each release publishes only its full upstream version tag, such as `1.3.1`.
 
 <!-- tiny-cli-images:version:age:end -->
 
diff --git a/images/age/image.toml b/images/age/image.toml
index 718be68..4b4813e 100644
--- a/images/age/image.toml
+++ b/images/age/image.toml
@@ -1,6 +1,6 @@
 name = "age"
 description = "Simple, modern, and secure file encryption"
-version = "1.3.0"
+version = "1.3.1"
 
 upstream = "FiloSottile/age"
 license = "BSD-3-Clause"
@@ -9,8 +9,8 @@ architectures = ["amd64", "arm64"]
 
 [platform.amd64]
 target = "linux-amd64"
-sha256 = "2635f17e469b8c829055151dcbf77effe1fbefe182cb7b308aee5d0e5d923aae"
+sha256 = "bdc69c09cbdd6cf8b1f333d372a1f58247b3a33146406333e30c0f26e8f51377"
 
 [platform.arm64]
 target = "linux-arm64"
-sha256 = "5c78a4de6aa89e86045e4c05fec5773f3c419a5c209cd7cb381fec0f5e8fa936"
+sha256 = "c6878a324421b69e3e20b00ba17c04bc5c6dab0030cfe55bf8f68fa8d9e9093a"