diff --git a/egress/Dockerfile b/egress/Dockerfile
index e1e269a..031db69 100644
--- a/egress/Dockerfile
+++ b/egress/Dockerfile
@@ -1,6 +1,6 @@
 # Egress proxy: HTTPS CONNECT only, and only to the allowlist in `filter`. Runners live on an internal network with
 # no way out of their own, so a manipulated agent cannot reach the LAN or send data to an arbitrary domain.
-FROM alpine:3.20
+FROM alpine:3.24
 RUN apk add --no-cache tinyproxy
 COPY tinyproxy.conf filter /etc/tinyproxy/
 USER tinyproxy