diff --git a/Dockerfile b/Dockerfile
index 8614e26..7783fb3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,7 +19,7 @@ RUN CGO_ENABLED=0 go build \
     -o /leakwatch .
 
 # Runtime stage
-FROM alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 # ADR-0003: Leakwatch uses go-git (pure Go), so the runtime image never shells
 # out to a git binary; only ca-certificates is needed for outbound TLS (e.g.
diff --git a/Dockerfile.goreleaser b/Dockerfile.goreleaser
index 567073d..1f55142 100644
--- a/Dockerfile.goreleaser
+++ b/Dockerfile.goreleaser
@@ -1,4 +1,4 @@
-FROM alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 # ADR-0003: Leakwatch uses go-git (pure Go), so the runtime image never shells
 # out to a git binary; only ca-certificates is needed for outbound TLS (e.g.