diff --git a/Dockerfile b/Dockerfile
index 87880d5b..279d9d51 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -41,7 +41,7 @@ RUN CGO_ENABLED=0 go build \
     -o pad ./cmd/pad
 
 # Stage 3: Runtime
-FROM alpine:3.23
+FROM alpine:3.24
 # ca-certificates: TLS roots for outbound HTTPS (e.g. Maileroo email).
 # tzdata: timezone names for Go's time package.
 # shadow: provides usermod / groupmod (BusyBox's adduser/addgroup don't
diff --git a/Dockerfile.goreleaser b/Dockerfile.goreleaser
index 1ecf6dcf..33c090ae 100644
--- a/Dockerfile.goreleaser
+++ b/Dockerfile.goreleaser
@@ -1,4 +1,4 @@
-FROM alpine:3.23
+FROM alpine:3.24
 # Keep this package set in lockstep with Dockerfile (the local build
 # variant) — both images must support the same docker-entrypoint.sh
 # behavior. See Dockerfile for per-package rationale and TASK-1168 /