I haven’t seen tooling for rebasing OCI images yet. Considering you’d still have to do this and roll it out to the server, you can just re-run the CI, which would build the image again, but also test that it works with the new base image.