diff --git a/infrastructure/googleapis/Dockerfile b/infrastructure/googleapis/Dockerfile
index 0628b498..d3131352 100644
--- a/infrastructure/googleapis/Dockerfile
+++ b/infrastructure/googleapis/Dockerfile
@@ -1,6 +1,6 @@
 FROM marketplace.gcr.io/google/debian12:latest
 
-ARG BAZELISK_VERSION=1.26.0
+ARG BAZELISK_VERSION=1.28.1
 ARG BAZEL_VERSION=7.7.1
 
 RUN apt-get update && \
@@ -30,7 +30,10 @@ RUN mkdir -p /tools
 # Add bazelisk and bazel CLIs
 ADD https://github.com/bazelbuild/bazelisk/releases/download/v${BAZELISK_VERSION}/bazelisk-linux-amd64 /tools/bazelisk
 ADD https://github.com/bazelbuild/bazel/releases/download/${BAZEL_VERSION}/bazel-${BAZEL_VERSION}-linux-x86_64 /tools/bazel
-RUN chmod +x /tools/bazelisk /tools/bazel
+# Make the tools executable. These operations are performed in separate
+# layers to make it easier to determine where vulnerabilities come from.
+RUN chmod +x /tools/bazelisk
+RUN chmod +x /tools/bazel
 
 WORKDIR /