diff --git a/Dockerfile b/Dockerfile
index c123499..ff82e42 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -32,7 +32,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     cp /app/target/release/ccag-server /usr/local/bin/ccag-server
 
 # Runtime stage — minimal Alpine
-FROM alpine:3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
+FROM alpine:3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11
 RUN apk add --no-cache ca-certificates curl postgresql16-client && \
     addgroup -S proxy && adduser -S proxy -G proxy
 COPY --from=builder /usr/local/bin/ccag-server /usr/local/bin/
diff --git a/Dockerfile.release b/Dockerfile.release
index 5a4ccac..02c980c 100644
--- a/Dockerfile.release
+++ b/Dockerfile.release
@@ -1,6 +1,6 @@
 # Multi-arch release Dockerfile — uses pre-built binaries from CI
 # Used by the release workflow; for local builds use the standard Dockerfile
-FROM alpine:3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
+FROM alpine:3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11
 
 RUN apk add --no-cache ca-certificates curl postgresql16-client && \
     addgroup -S proxy && adduser -S proxy -G proxy