diff --git a/go.mod b/go.mod
index d4e8446c7..c3d5f7bf4 100644
--- a/go.mod
+++ b/go.mod
@@ -52,7 +52,7 @@ require (
 	github.com/moby/go-archive v0.2.0
 	github.com/moby/locker v1.0.1
 	github.com/moby/patternmatcher v0.6.1
-	github.com/moby/policy-helpers v0.0.0-20260612073044-d5411a945cfc
+	github.com/moby/policy-helpers v0.0.0-20260722051018-856be88baec4
 	github.com/moby/profiles/seccomp v0.2.3
 	github.com/moby/sys/mountinfo v0.7.2
 	github.com/moby/sys/reexec v0.1.0
diff --git a/go.sum b/go.sum
index ba8926be6..1513968b7 100644
--- a/go.sum
+++ b/go.sum
@@ -424,8 +424,8 @@ github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
 github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
-github.com/moby/policy-helpers v0.0.0-20260612073044-d5411a945cfc h1:dvhPFj1niuMP3CBCjhiZWJQr//+w1LOA8cHclFJnNe0=
-github.com/moby/policy-helpers v0.0.0-20260612073044-d5411a945cfc/go.mod h1:frGYJTxenVCGPa9doaqZSU9FqzT7bt+1dFeVAaCFoyQ=
+github.com/moby/policy-helpers v0.0.0-20260722051018-856be88baec4 h1:3uAZ4pSEOHW0dCkXOxb50ux0YE69lNCwr5MnT2Vf0O8=
+github.com/moby/policy-helpers v0.0.0-20260722051018-856be88baec4/go.mod h1:77BSYHqLljY8i6FWZhQ2V7xmgNP3eftoIRV5yHYspDs=
 github.com/moby/profiles/seccomp v0.2.3 h1:nrHNSiECQQvq4WjgceCUgJXIXUJBIswVQ133k4Do2mA=
 github.com/moby/profiles/seccomp v0.2.3/go.mod h1:8m3qkkWZXrRsMqlUUN2zyccnYmBf3EAdQYPMVJ3NBhk=
 github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
diff --git a/vendor/github.com/moby/policy-helpers/hashedrecordbundle.go b/vendor/github.com/moby/policy-helpers/hashedrecordbundle.go
index 823111d26..1ebc1e384 100644
--- a/vendor/github.com/moby/policy-helpers/hashedrecordbundle.go
+++ b/vendor/github.com/moby/policy-helpers/hashedrecordbundle.go
@@ -198,6 +198,13 @@ func (d *hashedRecordSignedEntity) Certificate() *x509.Certificate {
 	return d.cert.Certificate()
 }
 
+func (d *hashedRecordSignedEntity) Intermediates() []*x509.Certificate {
+	if d.isDHI {
+		return nil
+	}
+	return d.cert.Intermediates()
+}
+
 func (d *hashedRecordSignedEntity) PublicKey() verify.PublicKeyProvider {
 	if d.isDHI {
 		return bundle.PublicKey{}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 82ff3d05a..54df83bfd 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -810,8 +810,8 @@ github.com/moby/locker
 ## explicit; go 1.19
 github.com/moby/patternmatcher
 github.com/moby/patternmatcher/ignorefile
-# github.com/moby/policy-helpers v0.0.0-20260612073044-d5411a945cfc
-## explicit; go 1.25.0
+# github.com/moby/policy-helpers v0.0.0-20260722051018-856be88baec4
+## explicit; go 1.25.8
 github.com/moby/policy-helpers
 github.com/moby/policy-helpers/image
 github.com/moby/policy-helpers/roots