diff --git a/Dockerfile b/Dockerfile
index 565178a5..00ef942a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -50,7 +50,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build \
 # =============================================================================
 # Stage 2: Runtime (single image, all backends)
 # =============================================================================
-FROM debian:bookworm-slim@sha256:0104b334637a5f19aa9c983a91b54c89887c0984081f2068983107a6f6c21eeb
+FROM debian:bookworm-slim@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818
 
 # Runtime deps. docker.io/netcat for the docker backend + healthcheck; python3 +
 # librsvg + fonts are the lean provisioning floor for the *direct* backend (the
diff --git a/Dockerfile.mcp b/Dockerfile.mcp
index c137124b..05fe93de 100644
--- a/Dockerfile.mcp
+++ b/Dockerfile.mcp
@@ -29,7 +29,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build \
     -o /ethpandaops-panda-server ./cmd/server
 
 # Runtime stage
-FROM alpine:3.20
+FROM alpine:3.24
 
 WORKDIR /app
 
diff --git a/Dockerfile.proxy b/Dockerfile.proxy
index 0fdb8997..efd74ba7 100644
--- a/Dockerfile.proxy
+++ b/Dockerfile.proxy
@@ -29,7 +29,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build \
     -o /ethpandaops-panda-proxy ./cmd/proxy
 
 # Runtime stage
-FROM alpine:3.20
+FROM alpine:3.24
 
 WORKDIR /app
 
diff --git a/goreleaser.panda.Dockerfile b/goreleaser.panda.Dockerfile
index 5d5a6157..451043fb 100644
--- a/goreleaser.panda.Dockerfile
+++ b/goreleaser.panda.Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.24@sha256:a2d49ea686c2adfe3c992e47dc3b5e7fa6e6b5055609400dc2acaeb241c829f4
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 RUN apk add --no-cache ca-certificates tzdata
 
diff --git a/goreleaser.proxy.Dockerfile b/goreleaser.proxy.Dockerfile
index ad2bf615..58606a81 100644
--- a/goreleaser.proxy.Dockerfile
+++ b/goreleaser.proxy.Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.24@sha256:a2d49ea686c2adfe3c992e47dc3b5e7fa6e6b5055609400dc2acaeb241c829f4
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 RUN apk add --no-cache ca-certificates tzdata
 
diff --git a/goreleaser.server.Dockerfile b/goreleaser.server.Dockerfile
index 2a3053fc..1c3755ed 100644
--- a/goreleaser.server.Dockerfile
+++ b/goreleaser.server.Dockerfile
@@ -1,7 +1,7 @@
 # =============================================================================
 # Runtime
 # =============================================================================
-FROM alpine:3.24@sha256:a2d49ea686c2adfe3c992e47dc3b5e7fa6e6b5055609400dc2acaeb241c829f4
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 # shadow provides usermod/groupmod, which the entrypoint uses to re-number the
 # panda user to the owner of the mounted credentials (non-1000 host UIDs).