diff --git a/Dockerfile b/Dockerfile
index a60275cb..cd4c5d2c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -49,7 +49,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     -o hawk ./cmd/hawk
 
 # Runtime stage — Alpine (hawk requires git + bash for workspace operations; distroless excluded)
-FROM alpine:3.23.5@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 RUN apk upgrade --no-cache && \
     apk add --no-cache ca-certificates git bash tini && \
diff --git a/Dockerfile.daemon b/Dockerfile.daemon
index 5ed3b77e..1b6d132c 100644
--- a/Dockerfile.daemon
+++ b/Dockerfile.daemon
@@ -31,7 +31,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
       -X main.BuildDate=${BUILD_DATE}" \
     -o hawk ./cmd/hawk
 
-FROM alpine:3.23.5@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 RUN apk upgrade --no-cache && \
     apk add --no-cache ca-certificates git bash curl tini && \
diff --git a/internal/sandbox/sandbox.Dockerfile b/internal/sandbox/sandbox.Dockerfile
index 949ce57f..7aa86c24 100644
--- a/internal/sandbox/sandbox.Dockerfile
+++ b/internal/sandbox/sandbox.Dockerfile
@@ -1,4 +1,4 @@
-FROM node:22-bookworm-slim@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436
+FROM node:22-bookworm-slim@sha256:4d676821dff059fd00d277ee4261ef34ea712317fed0737c03941481b5760c96
 
 RUN npm install --global npm@12.0.2 && \
     npm cache clean --force && \