diff --git a/Dockerfile b/Dockerfile
index 79a7afa..db785d6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,7 +14,7 @@ ARG TALOSCTL_VERSION=1.9.2
 # renovate: datasource=github-releases depName=budimanjojo/talhelper versioning=semver
 ARG TALHELPER_VERSION=3.0.39
 # renovate: datasource=github-releases depName=getsops/sops versioning=semver
-ARG SOPS_VERSION=3.9.1
+ARG SOPS_VERSION=3.11.0
 
 # renovate: datasource=docker depName=cgr.dev/chainguard/wolfi-base
 FROM cgr.dev/chainguard/wolfi-base:latest AS downloader
@@ -83,7 +83,7 @@ RUN . /tmp/arches.env; \
     if curl -fsSL -o /tmp/sops.sha256 "${SOPS_URL}.sha256"; then \
       SOPS_SHA=$(tr -d ' \n\r' < /tmp/sops.sha256); \
     else \
-      curl -fsSL -o /tmp/sops_checksums.txt "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/checksums.txt"; \
+      curl -fsSL -o /tmp/sops_checksums.txt "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.checksums.txt"; \
       SOPS_SHA=$(grep "$(basename ${SOPS_URL})" /tmp/sops_checksums.txt | awk '{print $1}' | tr -d ' \n\r'); \
     fi; \
     echo "${SOPS_SHA}  /tmp/sops" | sha256sum -c -; \
diff --git a/README.md b/README.md
index aa9477d..9d52e7a 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ An OCI image (Wolfi-based) containing:
 - sops
 
 The image is built on Wolfi to keep size and surface area minimal, then built via Forgejo Actions. On pushes to `main` (or `master`), the image is pushed to your Forgejo container registry. On other branches, the workflow builds the image but does not push it (to validate PRs). The published tag encodes the versions of all three tools:
-- Tag format: `v<TALOSCTL>-<TALHELPER>-<SOPS>` (for example: `v1.9.2-3.0.39-3.9.1`), plus `latest`.
+- Tag format: `v<TALOSCTL>-<TALHELPER>-<SOPS>` (for example: `v1.9.2-3.0.39-3.11.0`), plus `latest`.
 
 Contents are defined in `Dockerfile`. Versions are pinned via build `ARG`s so they can be updated automatically by Renovate.
 Additionally, the build verifies SHA256 checksums for all downloaded binaries and includes their source URLs and checksums inside the image at `/usr/local/share/checksums/`.
@@ -39,13 +39,13 @@ To build locally (example versions):
 docker build \
   --build-arg TALOSCTL_VERSION=1.9.2 \
   --build-arg TALHELPER_VERSION=3.0.39 \
-  --build-arg SOPS_VERSION=3.9.1 \
+  --build-arg SOPS_VERSION=3.11.0 \
   -t talos-tools:dev .
 ```
 
 Image usage
 ```
-docker run --rm -it your.registry/owner/talos-tools:v1.9.2-3.0.39-3.9.1 talosctl version --client
+docker run --rm -it your.registry/owner/talos-tools:v1.9.2-3.0.39-3.11.0 talosctl version --client
 ```
 
 Notes