diff --git a/denis/final.py b/denis/final.py
index a31e2b74..c76b25a7 100755
--- a/denis/final.py
+++ b/denis/final.py
@@ -1,12 +1,18 @@
 #!/usr/bin/env python3
 import sys
+import os
 
 import utilities
+import orbit.db
 
 assignment = sys.argv[1]
 
 usernames_to_subs = utilities.user_to_sub(assignment, 'final')
 
+for oopsie in orbit.db.Oopsie.select().where(orbit.db.Oopsie.assignment == assignment):
+    if usernames_to_subs[oopsie.user] is not None:
+        os.system(f'restrict_access /var/lib/email/journal/journal -a {oopsie.user}')
+
 utilities.release_subs([sub.submission_id for sub in usernames_to_subs.values() if sub])
 
 print(f'final subs for {assignment} released')
diff --git a/orbit/radius.py b/orbit/radius.py
index 244e86aa..3046fc3d 100644
--- a/orbit/radius.py
+++ b/orbit/radius.py
@@ -810,7 +810,7 @@ def handle_containerfile(rocket):
             not (fullname := user.fullname)):
         fullname = 'Unknown'
     return rocket.raw_respond(HTTPStatus.OK, rf'''
-FROM fedora:41
+FROM fedora:42
 
 RUN <<DNF
 dnf -y update