diff --git a/Dockerfile b/Dockerfile
index 04f5cdb1929f730fcabfdc1f28214841762ab642..1b4b5a930a4461e23818861e19cdf8c9d433ea6c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 FROM ubuntu:trusty
 MAINTAINER patrick@oberdorf.net
 
-ENV VERSION 1.6.3
+ENV VERSION 1.6.4
 
 WORKDIR /usr/local/src/
 ADD assets/sha256checksum sha256checksum
diff --git a/README.md b/README.md
index a1a45bd02a55e8c95c7796a4fc57dd698569ebc8..41c2b0865220df2fd9d2910af6d06380cb79b7b0 100644
--- a/README.md
+++ b/README.md
@@ -6,12 +6,12 @@ Unbound (with DNSSEC validation)
 
 Just use this command to start the container. Unbound will listen on port 53/udp.
 
-```docker run --name unbound -d -p 53:53/udp -p 53:53 secns/unbound:1.6.3```
+```docker run --name unbound -d -p 53:53/udp -p 53:53 secns/unbound:1.6.4```
 
 (optional)
 If you want to override the nameserver in the unbound container, you can use:
 
-```docker run --name unbound -d -p 53:53/udp -p 53:53 --dns="127.0.0.1" secns/unbound:1.6.3```
+```docker run --name unbound -d -p 53:53/udp -p 53:53 --dns="127.0.0.1" secns/unbound:1.6.4```
 
 # Configuration
 These options can be set via the environment variable -e flag:
diff --git a/assets/sha256checksum b/assets/sha256checksum
index 58fb9085549f0ef6d068f4dcfe40b71f0a568fd8..8d26017fb5fcf08191c51f34f966e633e169c539 100644
--- a/assets/sha256checksum
+++ b/assets/sha256checksum
@@ -1 +1 @@
-4c7e655c1d0d2d133fdeb81bc1ab3aa5c155700f66c9f5fb53fa6a5c3ea9845f unbound-1.6.3.tar.gz
+df0a88816ec31ccb8284c9eb132e1166fbf6d9cde71fbc4b8cd08a91ee777fed unbound-1.6.4.tar.gz
diff --git a/docker-compose.yml b/docker-compose.yml
index 5165e4e013250c3c4a9eaa1f67de815aded34e15..5b291f97f05c8e4ea9173aa0b0e2dae6f2e5e928 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,5 +1,5 @@
 unbound:
-  image: secns/unbound:1.6.1
+  image: secns/unbound:1.6.4
   ports:
   - "53:53/udp"
   - "53:53"