diff --git a/project/deps/package.mill.scala b/project/deps/package.mill.scala
index d8327f61ad..cb80bc2827 100644
--- a/project/deps/package.mill.scala
+++ b/project/deps/package.mill.scala
@@ -280,9 +280,9 @@ def buildCsVersion   = Deps.Versions.coursierCli
 def buildCsM1Version = Deps.Versions.coursierM1Cli
 
 // Native library used to encrypt GitHub secrets
-def libsodiumVersion = "1.0.18"
+def libsodiumVersion = "1.0.20"
 // Using the libsodium static library from this Alpine version (in the static launcher)
-def alpineVersion = "3.16"
+def alpineVersion = "3.21"
 def ubuntuVersion = "24.04"
 
 object Docker {
diff --git a/project/settings/package.mill.scala b/project/settings/package.mill.scala
index c7c56bb376..a17dca5eca 100644
--- a/project/settings/package.mill.scala
+++ b/project/settings/package.mill.scala
@@ -233,12 +233,29 @@ trait CliLaunchers extends SbtModule { self =>
       os.copy.over(libPath, destDir / s"${prefix}sodiumjni.$ext")
     }
     private def copyLibsodiumStaticTo(cs: String, destDir: os.Path, workspace: os.Path): Unit = {
-      val dirRes = os.proc(
-        cs,
-        "get",
-        "--archive",
-        s"https://download.libsodium.org/libsodium/releases/libsodium-$libsodiumVersion-stable-msvc.zip"
-      ).call()
+      val dirRes = {
+        val stable = os.proc(
+          cs,
+          "get",
+          "--archive",
+          s"https://download.libsodium.org/libsodium/releases/libsodium-$libsodiumVersion-stable-msvc.zip"
+        ).call(check = false)
+        if (stable.exitCode == 0) stable
+        else {
+          System.err.println(
+            s"Failed to download stable libsodium $libsodiumVersion from https://download.libsodium.org/libsodium/releases"
+          )
+          System.err.println(
+            "falling back to https://github.com/jedisct1/libsodium/releases *-RELEASE"
+          )
+          os.proc( // fallback to GitHuB *-RELEASE version
+            cs,
+            "get",
+            "--archive",
+            s"https://github.com/jedisct1/libsodium/releases/download/$libsodiumVersion-RELEASE/libsodium-$libsodiumVersion-msvc.zip"
+          ).call()
+        }
+      }
       val dir = os.Path(dirRes.out.trim(), workspace)
       os.copy.over(
         dir / "libsodium" / "x64" / "Release" / "v143" / "static" / "libsodium.lib",