diff --git a/bump-riverside.sh b/bump-riverside.sh
new file mode 100755
index 0000000..38b4bce
--- /dev/null
+++ b/bump-riverside.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+COMPOSE=/root/petersweb-infra/nixos/arion-riverside/arion-compose.nix
+
+usage() {
+  echo "Usage: $0 <sha256-digest>"
+  echo "  e.g. $0 sha256:6cf107d892fbb7f615b4e616b330209704b9d7a2ed204e05c830c3a4d0bfa308"
+  exit 1
+}
+
+[[ $# -eq 1 ]] || usage
+
+NEW_DIGEST="${1#sha256:}"   # strip leading "sha256:" if provided
+
+# Validate: hex string of the right length
+if ! [[ "$NEW_DIGEST" =~ ^[0-9a-f]{64}$ ]]; then
+  echo "Error: digest must be a 64-character lowercase hex string (got: $NEW_DIGEST)" >&2
+  exit 1
+fi
+
+OLD_LINE=$(grep -n 'riverside@sha256:' "$COMPOSE")
+echo "Current: $OLD_LINE"
+
+sed -i -E "s|(riverside@sha256:)[0-9a-f]{64}|\1${NEW_DIGEST}|" "$COMPOSE"
+
+NEW_LINE=$(grep -n 'riverside@sha256:' "$COMPOSE")
+echo "Updated: $NEW_LINE"
diff --git a/nixos/arion-riverside/arion-compose.nix b/nixos/arion-riverside/arion-compose.nix
index 8b0054e..d6572b0 100644
--- a/nixos/arion-riverside/arion-compose.nix
+++ b/nixos/arion-riverside/arion-compose.nix
@@ -7,7 +7,7 @@
   services = {
     app = {
       service = {
-        image = "forge.quinefoundation.com/ironmagma/riverside@sha256:23c17a769f001c0c41eb78119183549f884555e5604f017b1e03858dc5888d60";
+        image = "forge.quinefoundation.com/ironmagma/riverside@sha256:6cf107d892fbb7f615b4e616b330209704b9d7a2ed204e05c830c3a4d0bfa308";
         container_name = "riverside";
         restart = "unless-stopped";
         networks = [ "riverside" ];