diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index e795825084f..0bdfbd38b85 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM mcr.microsoft.com/devcontainers/go:2-1.27-bookworm
+FROM mcr.microsoft.com/devcontainers/go:2-1.27-trixie
 
 ENV DEVLAKE_PLUGINS=argocd,bamboo,bitbucket,circleci,customize,dora,gitextractor,github,github_graphql,gitlab,issue_trace,jenkins,jira,org,pagerduty,refdiff,slack,sonarqube,trello,webhook
 
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index e6564dd2f84..c6f26336ec0 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -24,7 +24,7 @@
     "ghcr.io/jungaretti/features/make:1": {},
     "ghcr.io/devcontainers/features/docker-in-docker:2.12.0": {},
     "ghcr.io/devcontainers/features/python:1": {
-      "version": "3.11"
+      "version": "3.14"
     },
     "ghcr.io/devcontainers-extra/features/poetry:2": {},
     "ghcr.io/devcontainers/features/node:1": {
diff --git a/backend/Dockerfile b/backend/Dockerfile
index 078fcd17882..a8a3b230836 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -28,7 +28,7 @@
 # pinned and Dependabot keeps it current through this FROM line.
 FROM ghcr.io/astral-sh/uv:0.13.7 as uv
 
-FROM --platform=$BUILDPLATFORM golang:1.27-bookworm as builder
+FROM --platform=$BUILDPLATFORM golang:1.27-trixie as builder
 
 # docker build --build-arg GOPROXY=https://goproxy.io,direct -t mericodev/lake .
 ARG GOPROXY=
@@ -64,7 +64,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
     DEVLAKE_PLUGINS="$GO_PLUGINS" make all
 
 
-FROM python:3.11-slim-bookworm as base
+FROM python:3.14-slim-trixie as base
 
 # apt-get upgrade picks up Debian security fixes that the base tag does not contain yet
 RUN apt-get update && \
@@ -85,7 +85,8 @@ RUN apt-get update && \
 
 EXPOSE 8080
 
-RUN useradd -ms /bin/bash -d /app devlake -u 1010 -G 0
+# trixie's login.defs sets HOME_MODE 0700; keep /app traversable for a random UID.
+RUN useradd -ms /bin/bash -d /app -K HOME_MODE=0755 devlake -u 1010 -G 0
 RUN chown -R devlake:devlake /etc/ssl/certs
 USER devlake
 ENV PYTHONUNBUFFERED=1
diff --git a/backend/Dockerfile.local b/backend/Dockerfile.local
index 7540e8b5e4e..0e7dd320f9d 100644
--- a/backend/Dockerfile.local
+++ b/backend/Dockerfile.local
@@ -23,7 +23,7 @@
 #While incubation status is not necessarily a reflection of the completeness or stability of the code,
 #it does indicate that the project has yet to be fully endorsed by the ASF.
 
-FROM golang:1.27-bookworm as builder
+FROM golang:1.27-trixie as builder
 
 ARG GOPROXY=
 ARG HTTP_PROXY=
@@ -65,13 +65,13 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
     --mount=type=cache,target=/go/pkg/mod \
     VERSION=${TAG}@${SHA} make build
 
-FROM debian:bookworm-slim
+FROM debian:trixie-slim
 
 RUN apt-get update && apt-get install -y \
     ca-certificates \
     # gitextractor shells out to the git CLI, so the binary must be present or
     # every clone fails with "git: executable file not found in $PATH".
-    # debian:bookworm-slim does not ship it; the official image inherits it from
+    # debian:trixie-slim does not ship it; the official image inherits it from
     # its python base.
     git \
     && rm -rf /var/lib/apt/lists/*
diff --git a/backend/python/DevelopmentSetup.md b/backend/python/DevelopmentSetup.md
index c171bd81dbf..e6fc7cd3985 100644
--- a/backend/python/DevelopmentSetup.md
+++ b/backend/python/DevelopmentSetup.md
@@ -22,9 +22,9 @@ limitations under the License.
 For the Python plugin tests to run properly, the following steps must be taken:
 
 1. The following packages are required for Ubuntu: `libffi-dev default-libmysqlclient-dev libpq-dev`
-2. `python3.11` is required by the time of this document.
-   - Try `deadsnakes` if you are using Ubuntu 22.04 or above, the `python3.11-dev` is required.
-   - Use `virtualenv` if you are having multiple python versions. `virtualenv -p python3.11 path/to/venv` and `source path/to/venv/bin/activate.sh` should do the trick
+2. `python3.14` is required by the time of this document.
+   - Try `deadsnakes` if you are using Ubuntu 22.04 or above, the `python3.14-dev` is required.
+   - Use `virtualenv` if you are having multiple python versions. `virtualenv -p python3.14 path/to/venv` and `source path/to/venv/bin/activate.sh` should do the trick
 3. both `mysql-client` and `postgresql` are required.
    - `postgresql` is required for `psycopg2` to work
 4. [poetry](https://python-poetry.org/) is required.
diff --git a/backend/python/plugins/azuredevops/poetry.lock b/backend/python/plugins/azuredevops/poetry.lock
index 30a29cd71e5..d5762fa4fb6 100644
--- a/backend/python/plugins/azuredevops/poetry.lock
+++ b/backend/python/plugins/azuredevops/poetry.lock
@@ -665,7 +665,7 @@ name = "pydevlake"
 version = "0.1.0"
 description = "Devlake plugin framework"
 optional = false
-python-versions = ">=3.11,<3.12"
+python-versions = ">=3.14,<3.15"
 groups = ["main"]
 files = []
 develop = true
@@ -923,5 +923,5 @@ zstd = ["backports-zstd (>=1.0.0) ; python_version < \"3.14\""]
 
 [metadata]
 lock-version = "2.1"
-python-versions = ">=3.11,<3.12"
-content-hash = "78407e54fb2d2ddfe04ff90e562a064df550475a2d050282efebad9cdaaad7b1"
+python-versions = ">=3.14,<3.15"
+content-hash = "585a98a451fb48f967e77b1923277b16e279472ea34e7c9ea57a1cd95eb248e0"
diff --git a/backend/python/plugins/azuredevops/pyproject.toml b/backend/python/plugins/azuredevops/pyproject.toml
index b0ee7cf60a2..214b4940e0a 100644
--- a/backend/python/plugins/azuredevops/pyproject.toml
+++ b/backend/python/plugins/azuredevops/pyproject.toml
@@ -21,7 +21,7 @@ authors = ["Hezheng Yin <hezheng@merico.dev>"]
 readme = "README.md"
 
 [tool.poetry.dependencies]
-python = ">=3.11,<3.12"
+python = ">=3.14,<3.15"
 pydevlake = { path = "../../pydevlake", develop = true }
 
 
diff --git a/backend/python/plugins/glpi/pyproject.toml b/backend/python/plugins/glpi/pyproject.toml
index f76b45e530e..fd03345d000 100644
--- a/backend/python/plugins/glpi/pyproject.toml
+++ b/backend/python/plugins/glpi/pyproject.toml
@@ -21,7 +21,7 @@ authors = ["Roger Abelenda <3179183+rabelenda@users.noreply.github.com>"]
 readme = "README.md"
 
 [tool.poetry.dependencies]
-python = ">=3.11,<3.12"
+python = ">=3.14,<3.15"
 pydevlake = { path = "../../pydevlake", develop = true }
 
 [tool.poetry.group.dev.dependencies]
diff --git a/backend/python/plugins/redmine/pyproject.toml b/backend/python/plugins/redmine/pyproject.toml
index aa1b847ecb0..e4fe9e836c3 100644
--- a/backend/python/plugins/redmine/pyproject.toml
+++ b/backend/python/plugins/redmine/pyproject.toml
@@ -21,7 +21,7 @@ authors = ["Roger Abelenda <3179183+rabelenda@users.noreply.github.com>"]
 readme = "README.md"
 
 [tool.poetry.dependencies]
-python = ">=3.11,<3.12"
+python = ">=3.14,<3.15"
 pydevlake = { path = "../../pydevlake", develop = true }
 
 [tool.poetry.group.dev.dependencies]
diff --git a/backend/python/plugins/zephyr/pyproject.toml b/backend/python/plugins/zephyr/pyproject.toml
index e896bcc5142..9a49a60f124 100644
--- a/backend/python/plugins/zephyr/pyproject.toml
+++ b/backend/python/plugins/zephyr/pyproject.toml
@@ -21,7 +21,7 @@ authors = ["Roger Abelenda <3179183+rabelenda@users.noreply.github.com>"]
 readme = "README.md"
 
 [tool.poetry.dependencies]
-python = ">=3.11,<3.12"
+python = ">=3.14,<3.15"
 pydevlake = { path = "../../pydevlake", develop = true }
 
 [tool.poetry.group.dev.dependencies]
diff --git a/backend/python/pydevlake/poetry.lock b/backend/python/pydevlake/poetry.lock
index b366bd1a612..8c96666ffd2 100644
--- a/backend/python/pydevlake/poetry.lock
+++ b/backend/python/pydevlake/poetry.lock
@@ -950,5 +950,5 @@ zstd = ["backports-zstd (>=1.0.0) ; python_version < \"3.14\""]
 
 [metadata]
 lock-version = "2.1"
-python-versions = ">=3.11,<3.12"
-content-hash = "ba760004b773bc1f0854c85809c957d1d8ea9cb1eccc901305694c9d7de8417d"
+python-versions = ">=3.14,<3.15"
+content-hash = "41e368d4489d2fbbefd15d0a484ef849340b6c17ef03ba151cb237ab83a9ecb5"
diff --git a/backend/python/pydevlake/pyproject.toml b/backend/python/pydevlake/pyproject.toml
index fa759d94098..d8f7a9277e7 100644
--- a/backend/python/pydevlake/pyproject.toml
+++ b/backend/python/pydevlake/pyproject.toml
@@ -22,7 +22,7 @@ license = "Apache-2.0"
 readme = "README.md"
 
 [tool.poetry.dependencies]
-python = ">=3.11,<3.12"
+python = ">=3.14,<3.15"
 sqlmodel = "^0.0.38"
 mysqlclient = "^2.1.1"
 requests = "^2.28.1"
diff --git a/backend/python/test/fakeplugin/poetry.lock b/backend/python/test/fakeplugin/poetry.lock
index ec6782adcd7..cd60bf838b5 100644
--- a/backend/python/test/fakeplugin/poetry.lock
+++ b/backend/python/test/fakeplugin/poetry.lock
@@ -665,7 +665,7 @@ name = "pydevlake"
 version = "0.1.0"
 description = "Devlake plugin framework"
 optional = false
-python-versions = ">=3.11,<3.12"
+python-versions = ">=3.14,<3.15"
 groups = ["main"]
 files = []
 develop = true
@@ -923,5 +923,5 @@ zstd = ["backports-zstd (>=1.0.0) ; python_version < \"3.14\""]
 
 [metadata]
 lock-version = "2.1"
-python-versions = ">=3.11,<3.12"
-content-hash = "5db22af317d36524b8188aa25d13fdb3861e379699f4eb86944e7bb58c79f49a"
+python-versions = ">=3.14,<3.15"
+content-hash = "34b1d9618c6f82658528288fee62f704db6e673f5dc7a6e5d8650b54ee727468"
diff --git a/backend/python/test/fakeplugin/pyproject.toml b/backend/python/test/fakeplugin/pyproject.toml
index d72afa4f9b3..2c90b8ec269 100644
--- a/backend/python/test/fakeplugin/pyproject.toml
+++ b/backend/python/test/fakeplugin/pyproject.toml
@@ -20,7 +20,7 @@ description = "Fake python plugin used only in tests"
 authors = []
 
 [tool.poetry.dependencies]
-python = ">=3.11,<3.12"
+python = ">=3.14,<3.15"
 pydevlake = { path = "../../pydevlake", develop = true }
 
 
diff --git a/backend/python/uv.sh b/backend/python/uv.sh
index b775b9787c0..da4eff3cbc2 100755
--- a/backend/python/uv.sh
+++ b/backend/python/uv.sh
@@ -50,7 +50,7 @@ sync_project() {
     rm -rf .venv
   fi
   if [ ! -x .venv/bin/python ]; then
-    uv venv --python "${DEVLAKE_PYTHON_VERSION:-3.11}" .venv
+    uv venv --python "${DEVLAKE_PYTHON_VERSION:-3.14}" .venv
   fi
   uv pip install --python .venv/bin/python -e .
 }
diff --git a/devops/docker/lake-builder/Dockerfile b/devops/docker/lake-builder/Dockerfile
index 9c96447895a..7f9ed9fe36d 100644
--- a/devops/docker/lake-builder/Dockerfile
+++ b/devops/docker/lake-builder/Dockerfile
@@ -18,7 +18,7 @@
 FROM ghcr.io/astral-sh/uv:0.13.7 AS uv
 
 # Same Python line as the runtime image in backend/Dockerfile.
-FROM python:3.11-slim-bookworm
+FROM python:3.14-slim-trixie
 
 RUN apt -y update && apt -y upgrade && apt -y install tzdata make tar curl gcc g++ pkg-config git \
     zlib1g libffi-dev  \