diff --git a/Dockerfile b/Dockerfile
index 9219d90..eb002dd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-# syntax = docker/dockerfile-upstream:1.10.0-labs
+# syntax = docker/dockerfile-upstream:1.12.1-labs
 
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
@@ -6,12 +6,12 @@
 
 ARG TOOLCHAIN
 
-FROM ghcr.io/siderolabs/ca-certificates:v1.8.0 AS image-ca-certificates
+FROM ghcr.io/siderolabs/ca-certificates:v1.9.0 AS image-ca-certificates
 
-FROM ghcr.io/siderolabs/fhs:v1.8.0 AS image-fhs
+FROM ghcr.io/siderolabs/fhs:v1.9.0 AS image-fhs
 
 # runs markdownlint
-FROM docker.io/oven/bun:1.1.29-alpine AS lint-markdown
+FROM docker.io/oven/bun:1.1.38-alpine AS lint-markdown
 WORKDIR /src
 RUN bun i markdownlint-cli@0.41.0 sentences-per-line@0.2.1
 COPY .markdownlint.json .
diff --git a/internal/pkg/constants/build.go b/internal/pkg/constants/build.go
index 182f7f1..5e85220 100644
--- a/internal/pkg/constants/build.go
+++ b/internal/pkg/constants/build.go
@@ -8,7 +8,7 @@ import "os"
 
 // DefaultBaseImage for non-scratch builds.
 // renovate: datasource=docker versioning=docker depName=alpine
-const DefaultBaseImage = "docker.io/alpine:3.20"
+const DefaultBaseImage = "docker.io/alpine:3.21"
 
 // DefaultDirMode is UNIX file mode for mkdir.
 const DefaultDirMode os.FileMode = 0o755