diff --git a/Dockerfile b/Dockerfile
index ad00d2f..c033811 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -29,12 +29,12 @@ RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -trimpath -ldflags=
 
 # The debroxy user and /data, made on the build platform; the same Alpine
 # release, so its account files fit the target image.
-FROM --platform=$BUILDPLATFORM alpine:3.24.2 AS accounts
+FROM --platform=$BUILDPLATFORM alpine:3.24.3 AS accounts
 RUN addgroup -S -g 65532 debroxy \
 	&& adduser -S -D -H -u 65532 -G debroxy -h /data debroxy \
 	&& install -d -o debroxy -g debroxy -m 0700 /data
 
-FROM alpine:3.24.2
+FROM alpine:3.24.3
 # The base image already carries the CA bundle (ca-certificates-bundle).
 # A new named volume takes /data's owner: the non-root debroxy user.
 COPY --from=accounts /etc/passwd /etc/group /etc/shadow /etc/