diff --git a/Dockerfile b/Dockerfile
index 479d894d80..71366e2793 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,7 +11,7 @@ WORKDIR /src
 RUN go build ./cmd/src
 
 # This stage should be kept in sync with Dockerfile.release.
-FROM alpine:3.24@sha256:ff7f0c727dd796aa36787bfcd9a64bf35a6ce72a73451b3359fde849b6703d63
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 
 # needed for `src code-intel upload` and `src actions exec`
 # ca-certificates-bundle >= 20261020-r0 drops the eMudhra roots (CVE-2026-111943).
diff --git a/Dockerfile.release b/Dockerfile.release
index ca867b82ac..bac05ee89f 100644
--- a/Dockerfile.release
+++ b/Dockerfile.release
@@ -2,7 +2,7 @@
 # suitable for testing, since it depends on a src binary being at the project
 # root _and_ that src binary being runnable on Alpine. To test this, refer to
 # the main Dockerfile, which should have an identical second stage.
-FROM alpine:3.24@sha256:ff7f0c727dd796aa36787bfcd9a64bf35a6ce72a73451b3359fde849b6703d63
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 
 # needed for `src code-intel upload` and `src actions exec`
 # ca-certificates-bundle >= 20261020-r0 drops the eMudhra roots (CVE-2026-111943).
diff --git a/docker/batch-change-volume-workspace/Dockerfile b/docker/batch-change-volume-workspace/Dockerfile
index 6b1a3b4d85..46cafffaa8 100644
--- a/docker/batch-change-volume-workspace/Dockerfile
+++ b/docker/batch-change-volume-workspace/Dockerfile
@@ -2,7 +2,7 @@
 # image that we use to run curl, git, and unzip against a Docker volume when
 # using the volume workspace.
 
-FROM alpine:3.24@sha256:ff7f0c727dd796aa36787bfcd9a64bf35a6ce72a73451b3359fde849b6703d63
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 
 # ca-certificates-bundle >= 20261020-r0 drops the eMudhra roots (CVE-2026-111943).
 RUN apk add --update git unzip && apk upgrade --no-cache ca-certificates-bundle