diff --git a/stacks/sensitive/compose.yaml b/stacks/sensitive/compose.yaml
index 12b41a7c..bcf0b562 100644
--- a/stacks/sensitive/compose.yaml
+++ b/stacks/sensitive/compose.yaml
@@ -1122,7 +1122,7 @@ services:
   # --if-needed` the container runs before the webserver listens.
   paperless:
     <<: *service-defaults
-    image: ghcr.io/paperless-ngx/paperless-ngx:3.3.0@sha256:6b94799bc769a063b3340cc5847402e626d4d91d29a295a8e747f8e9bead4207
+    image: ghcr.io/paperless-ngx/paperless-ngx:3.3.1@sha256:cb91bfb468e63025a9d10c01b54c33665113668eee61b490db96de19b860b9c4
     container_name: sensitive-paperless
     # DIFFERENCE 5 again: s6-overlay as PID 1, and the same measured refusal
     # as home-assistant's — booted with the shared default, the container