diff --git a/stacks/sensitive/compose.yaml b/stacks/sensitive/compose.yaml
index f6a20aba..eac3b3e9 100644
--- a/stacks/sensitive/compose.yaml
+++ b/stacks/sensitive/compose.yaml
@@ -904,7 +904,7 @@ services:
   # --if-needed` the container runs before the webserver listens.
   paperless:
     <<: *service-defaults
-    image: ghcr.io/paperless-ngx/paperless-ngx:3.1.3@sha256:aa810a36942c63d4ee70d00eda7236cd3d6acfb7eb3f7987fb568ed14df8817a
+    image: ghcr.io/paperless-ngx/paperless-ngx:3.2.0@sha256:22dc423ff48ac1629977dbf0c9625ba9f60d3bd1291a2ff173c65351984a14c2
     container_name: sensitive-paperless
     # DIFFERENCE 5 again: s6-overlay as PID 1, and the same measured refusal
     # as home-assistant's — booted with the shared default, the container