diff --git a/Dockerfile b/Dockerfile
index 97dc480542..803c6106d1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,10 @@
 ARG GO_VERSION=1.24.7
 ARG BASE_DEBIAN_DISTRO="bookworm"
 ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}"
-ARG XX_VERSION=1.6.1
+
+# XX_VERSION specifies the version of the xx utility to use.
+# It must be a valid tag in the docker.io/tonistiigi/xx image repository.
+ARG XX_VERSION=1.7.0
 
 # VPNKIT_VERSION is the version of the vpnkit binary which is used as a fallback
 # network driver for rootless.
diff --git a/cmd/dockerd/winresources/Dockerfile b/cmd/dockerd/winresources/Dockerfile
index 746e1c1da7..29c40541ed 100644
--- a/cmd/dockerd/winresources/Dockerfile
+++ b/cmd/dockerd/winresources/Dockerfile
@@ -1,7 +1,10 @@
 # syntax=docker/dockerfile:1
 
 ARG DEBIAN_VERSION=bookworm
-ARG XX_VERSION=1.6.1
+
+# XX_VERSION specifies the version of the xx utility to use.
+# It must be a valid tag in the docker.io/tonistiigi/xx image repository.
+ARG XX_VERSION=1.7.0
 
 # xx is a helper for cross-compilation
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx