diff --git a/Dockerfile b/Dockerfile
index 18a5888..32e9b85 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -33,7 +33,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     cp /app/target/release/ccag-server /usr/local/bin/ccag-server
 
 # Runtime stage — minimal Alpine
-FROM alpine:3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 RUN apk add --no-cache ca-certificates curl postgresql16-client && \
     addgroup -S proxy && adduser -S proxy -G proxy
 COPY --from=builder /usr/local/bin/ccag-server /usr/local/bin/
diff --git a/Dockerfile.load b/Dockerfile.load
index a32cd98..f2f7dd2 100644
--- a/Dockerfile.load
+++ b/Dockerfile.load
@@ -28,7 +28,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     cargo build --release --bin ccag-server --features mock-bedrock && \
     cp /app/target/release/ccag-server /usr/local/bin/ccag-server
 
-FROM alpine:3.23
+FROM alpine:3.24
 RUN apk add --no-cache ca-certificates curl postgresql16-client && \
     addgroup -S proxy && adduser -S proxy -G proxy
 COPY --from=builder /usr/local/bin/ccag-server /usr/local/bin/
diff --git a/Dockerfile.release b/Dockerfile.release
index 5a4ccac..e2543e2 100644
--- a/Dockerfile.release
+++ b/Dockerfile.release
@@ -1,6 +1,6 @@
 # Multi-arch release Dockerfile — uses pre-built binaries from CI
 # Used by the release workflow; for local builds use the standard Dockerfile
-FROM alpine:3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 RUN apk add --no-cache ca-certificates curl postgresql16-client && \
     addgroup -S proxy && adduser -S proxy -G proxy