diff --git a/cli/Dockerfile b/cli/Dockerfile
index f425be9..ffbb8d1 100644
--- a/cli/Dockerfile
+++ b/cli/Dockerfile
@@ -56,7 +56,7 @@ RUN go build \
 
 # ---------- runtime ----------
 
-FROM alpine:3.20
+FROM alpine:3.24
 
 # ca-certificates so HTTPS to signal.fernsicht.space + GitHub release
 # downloads work out-of-the-box. tini for clean signal forwarding to