diff --git a/deploy/Dockerfile.controller b/deploy/Dockerfile.controller
index cbc050b..f3c955b 100644
--- a/deploy/Dockerfile.controller
+++ b/deploy/Dockerfile.controller
@@ -7,7 +7,7 @@ COPY web/ ./
 RUN npm run build
 
 # Build the controller binary
-FROM golang:1.26-alpine AS go
+FROM golang:1.27-alpine AS go
 ARG VERSION=dev
 WORKDIR /src
 COPY go.mod go.sum ./
@@ -19,7 +19,7 @@ RUN CGO_ENABLED=0 go build \
     -o /controller ./cmd/controller
 
 # Runtime image
-FROM alpine:3.22
+FROM alpine:3.24
 RUN adduser -D -H ghostfleet \
     && mkdir -p /var/lib/ghostfleet \
     && chown ghostfleet /var/lib/ghostfleet
diff --git a/deploy/Dockerfile.netboot b/deploy/Dockerfile.netboot
index a3b45ec..bc88dbe 100644
--- a/deploy/Dockerfile.netboot
+++ b/deploy/Dockerfile.netboot
@@ -3,7 +3,7 @@
 # script (avoids a second DHCP boot-option round and its loop-avoidance
 # complexity). Runs with host networking on the isolated interface.
 
-FROM alpine:3.22 AS ipxe
+FROM alpine:3.24 AS ipxe
 # Accepted for build uniformity (the release workflow passes VERSION to all
 # three images); nothing here stamps it.
 ARG VERSION=dev
@@ -20,7 +20,7 @@ RUN cd /ipxe/src \
     && make -j"$(nproc)" bin-x86_64-efi/snponly.efi EMBED=/embed.ipxe \
     && ls -lh bin-x86_64-efi/snponly.efi
 
-FROM alpine:3.22
+FROM alpine:3.24
 RUN apk add --no-cache dnsmasq
 COPY --from=ipxe /ipxe/src/bin-x86_64-efi/snponly.efi /tftp/snponly.efi
 COPY deploy/dnsmasq.conf.tmpl /etc/dnsmasq.conf.tmpl
diff --git a/deploy/Dockerfile.tempos b/deploy/Dockerfile.tempos
index 66f573e..7cc5ecf 100644
--- a/deploy/Dockerfile.tempos
+++ b/deploy/Dockerfile.tempos
@@ -5,7 +5,7 @@
 # volume served by the controller's /boot endpoints.
 
 # Agent binary (static)
-FROM golang:1.26-alpine AS agent
+FROM golang:1.27-alpine AS agent
 ARG VERSION=dev
 WORKDIR /src
 COPY go.mod go.sum ./
@@ -17,7 +17,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
     -o /agent ./cmd/agent
 
 # Kernel + initramfs assembly
-FROM alpine:3.22 AS build
+FROM alpine:3.24 AS build
 RUN apk add --no-cache linux-virt kmod cpio
 COPY deploy/tempos-init.sh /tmp/init
 COPY --from=agent /agent /tmp/agent
@@ -51,6 +51,6 @@ RUN set -e; \
     ls -lh /artifacts
 
 # Artifact carrier: copies artifacts into the mounted images volume.
-FROM alpine:3.22
+FROM alpine:3.24
 COPY --from=build /artifacts /artifacts
 CMD ["sh", "-c", "cp -v /artifacts/* /out/ && echo 'temp OS artifacts installed'"]