diff --git a/.github/workflows/build-and-publish.yaml b/.github/workflows/build-and-publish.yaml
index b9f100b2..7eafb0f2 100644
--- a/.github/workflows/build-and-publish.yaml
+++ b/.github/workflows/build-and-publish.yaml
@@ -10,7 +10,7 @@ permissions:
 
 env:
   CONTROLLER: ${{ github.event.repository.name }}
-  LIBCRYPTO_VERSION: "3.3.2-r0"
+  LIBCRYPTO_VERSION: "3.3.2-r4"
 
 jobs:
   test:
diff --git a/.github/workflows/release-runners.yaml b/.github/workflows/release-runners.yaml
index 38e40734..b100581a 100644
--- a/.github/workflows/release-runners.yaml
+++ b/.github/workflows/release-runners.yaml
@@ -18,7 +18,7 @@ permissions:
 env:
   VERSION: ${{ github.event.inputs.version }}
   BUILD_DATE: ${{ github.event.inputs.build_date }}
-  LIBCRYPTO_VERSION: "3.3.2-r0"
+  LIBCRYPTO_VERSION: "3.3.2-r4"
 
 jobs:
   release-base:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index bf330e48..96df9350 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,7 +15,7 @@ permissions:
 
 env:
   CONTROLLER: ${{ github.event.repository.name }}
-  LIBCRYPTO_VERSION: "3.3.2-r0"
+  LIBCRYPTO_VERSION: "3.3.2-r4"
 
 jobs:
   build-push:
diff --git a/Dockerfile b/Dockerfile
index a6a50385..cf79f3da 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -34,7 +34,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
         -ldflags "-X main.BuildSHA='${BUILD_SHA}' -X main.BuildVersion='${BUILD_VERSION}'" \
         -a -o tofu-controller ./cmd/manager
 
-FROM alpine:3.20
+FROM alpine:3.21
 
 LABEL org.opencontainers.image.source="https://github.com/flux-iac/tofu-controller"
 
diff --git a/Dockerfile.dev b/Dockerfile.dev
index c829dc76..bb3df586 100644
--- a/Dockerfile.dev
+++ b/Dockerfile.dev
@@ -1,4 +1,4 @@
-FROM alpine:3.20
+FROM alpine:3.21
 
 LABEL org.opencontainers.image.source="https://github.com/flux-iac/tofu-controller"
 
diff --git a/Makefile b/Makefile
index cf45972c..47670474 100644
--- a/Makefile
+++ b/Makefile
@@ -13,7 +13,7 @@ BUILD_VERSION ?= $(shell git describe --tags $$(git rev-list --tags --max-count=
 # - .github/workflows/release-runners.yaml
 # - .github/workflows/release.yaml
 # - Tiltfile
-LIBCRYPTO_VERSION ?= 3.3.2-r0
+LIBCRYPTO_VERSION ?= 3.3.2-r4
 
 # source controller version
 SOURCE_VER ?= v1.0.0-rc.1
diff --git a/Tiltfile b/Tiltfile
index a3df6662..b848eec2 100644
--- a/Tiltfile
+++ b/Tiltfile
@@ -8,7 +8,7 @@ tfNamespace      = "terraform"
 buildSHA         = str(local('git rev-parse --short HEAD')).rstrip('\n')
 buildVersionRef  = str(local('git rev-list --tags --max-count=1')).rstrip('\n')
 buildVersion     = str(local("git describe --tags ${buildVersionRef}")).rstrip('\n')
-LIBCRYPTO_VERSION = "3.3.2-r0"
+LIBCRYPTO_VERSION = "3.3.2-r4"
 
 if os.path.exists('Tiltfile.local'):
    include('Tiltfile.local')
diff --git a/planner.Dockerfile b/planner.Dockerfile
index 331d4fc7..cfa4a041 100644
--- a/planner.Dockerfile
+++ b/planner.Dockerfile
@@ -35,7 +35,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
       -o branch-planner \
       ./cmd/branch-planner
 
-FROM alpine:3.20
+FROM alpine:3.21
 
 LABEL org.opencontainers.image.source="https://github.com/flux-iac/tofu-controller"
 
diff --git a/planner.Dockerfile.dev b/planner.Dockerfile.dev
index 219e456c..df63e120 100644
--- a/planner.Dockerfile.dev
+++ b/planner.Dockerfile.dev
@@ -1,4 +1,4 @@
-FROM alpine:3.20
+FROM alpine:3.21
 
 LABEL org.opencontainers.image.source="https://github.com/flux-iac/tofu-controller"
 
diff --git a/runner-base.Dockerfile b/runner-base.Dockerfile
index 299e6a88..36a3d87d 100644
--- a/runner-base.Dockerfile
+++ b/runner-base.Dockerfile
@@ -38,7 +38,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
         -o tf-runner \
         ./cmd/runner/main.go
 
-FROM alpine:3.20
+FROM alpine:3.21
 
 LABEL org.opencontainers.image.source="https://github.com/flux-iac/tofu-controller"
 
diff --git a/runner.Dockerfile.dev b/runner.Dockerfile.dev
index 1070404c..7abe1da4 100644
--- a/runner.Dockerfile.dev
+++ b/runner.Dockerfile.dev
@@ -1,4 +1,4 @@
-FROM alpine:3.20 as base
+FROM alpine:3.21 as base
 
 LABEL org.opencontainers.image.source="https://github.com/flux-iac/tofu-controller"