diff --git a/.cirrus.yml b/.cirrus.yml
index 837675fd0b..d3c5a03e29 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -208,51 +208,51 @@ centosstream9_task:
     << : *RESOURCES_TEMPLATE
   << : *CI_TEMPLATE
 
-debian12_task:
+debian13_task:
   container:
-    # Debian 12 (bookworm) EOL: TBD
-    dockerfile: ci/debian-12/Dockerfile
+    # Debian 13 (trixie) EOL: TBD
+    dockerfile: ci/debian-13/Dockerfile
     << : *RESOURCES_TEMPLATE
   << : *CI_TEMPLATE
 
-arm_debian12_task:
+arm_debian13_task:
   arm_container:
-    # Debian 12 (bookworm) EOL: TBD
-    dockerfile: ci/debian-12/Dockerfile
+    # Debian 13 (trixie) EOL: TBD
+    dockerfile: ci/debian-13/Dockerfile
     << : *RESOURCES_TEMPLATE
   << : *CI_TEMPLATE
   env:
     ZEEK_CI_CONFIGURE_FLAGS: *NO_SPICY_CONFIG
 
-debian12_static_task:
+debian13_static_task:
   container:
     # Just use a recent/common distro to run a static compile test.
-    # Debian 12 (bookworm) EOL: TBD
-    dockerfile: ci/debian-12/Dockerfile
+    # Debian 13 (trixie) EOL: TBD
+    dockerfile: ci/debian-13/Dockerfile
     << : *RESOURCES_TEMPLATE
   << : *CI_TEMPLATE
   << : *SKIP_TASK_ON_PR
   env:
     ZEEK_CI_CONFIGURE_FLAGS: *STATIC_CONFIG
 
-debian12_binary_task:
+debian13_binary_task:
   container:
     # Just use a recent/common distro to run binary mode compile test.
     # As of 2024-03, the used configure flags are equivalent to the flags
     # that we use to create binary packages.
     # Just use a recent/common distro to run a static compile test.
-    # Debian 12 (bookworm) EOL: TBD
-    dockerfile: ci/debian-12/Dockerfile
+    # Debian 13 (trixie) EOL: TBD
+    dockerfile: ci/debian-13/Dockerfile
     << : *RESOURCES_TEMPLATE
   << : *CI_TEMPLATE
   << : *SKIP_TASK_ON_PR
   env:
     ZEEK_CI_CONFIGURE_FLAGS: *BINARY_CONFIG
 
-debian11_task:
+debian12_task:
   container:
-    # Debian 11 EOL: June 2026
-    dockerfile: ci/debian-11/Dockerfile
+    # Debian 12 (bookworm) EOL: TBD
+    dockerfile: ci/debian-12/Dockerfile
     << : *RESOURCES_TEMPLATE
   << : *CI_TEMPLATE
   << : *SKIP_TASK_ON_PR
diff --git a/ci/debian-11/Dockerfile b/ci/debian-13/Dockerfile
similarity index 64%
rename from ci/debian-11/Dockerfile
rename to ci/debian-13/Dockerfile
index a4a5442b65..a9bc9e8eea 100644
--- a/ci/debian-11/Dockerfile
+++ b/ci/debian-13/Dockerfile
@@ -1,32 +1,36 @@
-FROM debian:11
+FROM debian:13
 
 ENV DEBIAN_FRONTEND="noninteractive" TZ="America/Los_Angeles"
 
 # A version field to invalidate Cirrus's build cache when needed, as suggested in
 # https://github.com/cirruslabs/cirrus-ci-docs/issues/544#issuecomment-566066822
-ENV DOCKERFILE_VERSION 20241024
+ENV DOCKERFILE_VERSION 20250813
 
 RUN apt-get update && apt-get -y install \
     bison \
     bsdmainutils \
     ccache \
     cmake \
+    cppzmq-dev \
     curl \
+    dnsmasq \
     flex \
     g++ \
     gcc \
     git \
     jq \
     libkrb5-dev \
+    libnats-dev \
     libnode-dev \
     libpcap-dev \
+    librdkafka-dev \
     libssl-dev \
     libuv1-dev \
-    libzmq3-dev \
     make \
     python3 \
     python3-dev \
     python3-pip\
+    python3-websockets \
     sqlite3 \
     swig \
     wget \
@@ -35,4 +39,6 @@ RUN apt-get update && apt-get -y install \
   && apt autoclean \
   && rm -rf /var/lib/apt/lists/*
 
-RUN pip3 install websockets junit2html
+# Debian trixie really doesn't like using pip to install system wide stuff, but
+# doesn't seem there's a python3-junit2html package, so not sure what we'd break.
+RUN pip3 install --break-system-packages junit2html