diff --git a/doc/doxygen/src/using-rust.md b/doc/doxygen/src/using-rust.md
index c335fa9e4d..73f0534d9f 100644
--- a/doc/doxygen/src/using-rust.md
+++ b/doc/doxygen/src/using-rust.md
@@ -148,7 +148,7 @@ In addition to the Rust compiler you'll need to install the C2Rust transpiler;
 as this is using some recent fixes, it is best installed as:
 
 ```shell
-$ cargo install c2rust --git https://github.com/immunant/c2rust
+$ cargo install c2rust --git https://github.com/immunant/c2rust --tag v0.19.0
 ```
 
 If multiple versions of LLVM are installed locally, it may be necessary to prefix it with the selected LLVM version:
diff --git a/makefiles/docker.inc.mk b/makefiles/docker.inc.mk
index 34ef41e71d..7acb70ced5 100644
--- a/makefiles/docker.inc.mk
+++ b/makefiles/docker.inc.mk
@@ -1,8 +1,12 @@
 # This *MUST* be updated in lock-step with the riotbuild image in
 # https://github.com/RIOT-OS/riotdocker. The idea is that when checking out
 # a random RIOT merge commit, `make BUILD_IN_DOCKER=1` should always succeed.
-DOCKER_TESTED_IMAGE_ID := bbd6bc053ac3eafb173a475e0439376db91b9a88f4b504e1bfa4e0d432204e63
-DOCKER_TESTED_IMAGE_REPO_DIGEST := 52ee7ae8ec4f9b8852aac15cf349d748484cd4d0732b6e030eddf4fff854e799
+#
+# When the docker image is updated, checks at
+# dist/tools/buildsystem_sanity_check/check.sh start complaining in CI, and
+# provide the latest values to verify and fill in.
+DOCKER_TESTED_IMAGE_ID := 488d97b1b8285ca6a9518f177126fc5ab077135648ef40c1ac7867d16ac2d640
+DOCKER_TESTED_IMAGE_REPO_DIGEST := beb980f9ef00e7143fba913f3cb927866f987fe570141e145539c42141a940bd
 
 DOCKER_PULL_IDENTIFIER := docker.io/riot/riotbuild@sha256:$(DOCKER_TESTED_IMAGE_REPO_DIGEST)
 DOCKER_IMAGE_DEFAULT := sha256:$(DOCKER_TESTED_IMAGE_ID)