diff --git a/testenv/client.Dockerfile b/testenv/client.Dockerfile
index 2bc925c..e22a347 100644
--- a/testenv/client.Dockerfile
+++ b/testenv/client.Dockerfile
@@ -10,7 +10,7 @@ COPY cmd ./cmd
 COPY internal ./internal
 RUN CGO_ENABLED=0 go build -o /out/netssh ./cmd/netssh
 
-FROM alpine:3.23
+FROM alpine:3.24
 # xvfb/xterm/imagemagick/tesseract: render panes in a real terminal emulator,
 # take screenshots, and read them back with OCR (tests/16-render.sh).
 RUN apk add --no-cache openssh-client-default tmux zellij bash zsh fish bash-completion \
diff --git a/testenv/targets/target.Dockerfile b/testenv/targets/target.Dockerfile
index 751cc40..0e3eca7 100644
--- a/testenv/targets/target.Dockerfile
+++ b/testenv/targets/target.Dockerfile
@@ -1,6 +1,6 @@
 # SSH target for the netssh test environment: every NetBox host, the bastion,
 # and the static host run this image with a different hostname.
-FROM alpine:3.23
+FROM alpine:3.24
 
 # Alpine locks new accounts with "!"; sshd refuses key logins for locked
 # accounts, so the password field is set to "*" (no password, not locked).