diff --git a/.changelog/21729.txt b/.changelog/21729.txt
new file mode 100644
index 000000000000..ce334fdfe901
--- /dev/null
+++ b/.changelog/21729.txt
@@ -0,0 +1,4 @@
+```release-notes:security
+Bump Dockerfile base image to `alpine:3.20`.
+This resolves CVE-2024-7264 and CVE-2024-8096 (curl).
+```