diff --git a/Dockerfile b/Dockerfile
index baccab8e..e47055ba 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -47,13 +47,13 @@ RUN make release-binary ORG_PATH=${ORG_PATH} PROJ=${PROJ} VERSION=${VERSION}
 RUN xx-verify /go/bin/dex && xx-verify /go/bin/docker-entrypoint
 
 # 3) Stager for config & data
-FROM alpine:3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c AS stager
+FROM alpine:3.22.2@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412 AS stager
 
 RUN mkdir -p /var/dex /etc/dex
 COPY config.docker.yaml /etc/dex/
 
 # 4) Gomplate
-FROM alpine:3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c AS gomplate
+FROM alpine:3.22.2@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412 AS gomplate
 
 ARG TARGETOS TARGETARCH TARGETVARIANT
 ENV GOMPLATE_VERSION=v4.3.0
@@ -63,7 +63,7 @@ RUN wget -O /usr/local/bin/gomplate \
     && chmod +x /usr/local/bin/gomplate
 
 # 5) Dummy stages for Dependabot
-FROM alpine:3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c AS alpine
+FROM alpine:3.22.2@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412 AS alpine
 FROM gcr.io/distroless/static-debian12:nonroot@sha256:c0f429e16b13e583da7e5a6ec20dd656d325d88e6819cafe0adb0828976529dc AS distroless
 
 # 6) Final image