diff --git a/microservices/services/audit/Dockerfile b/microservices/services/audit/Dockerfile
index c76768f..c181e44 100644
--- a/microservices/services/audit/Dockerfile
+++ b/microservices/services/audit/Dockerfile
@@ -24,12 +24,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 
 # Run the audit-service on a pinned Alpine image as an unprivileged user.
 # Configuration is environment-only; migrations are owned by the monolith.
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY audit/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 
 WORKDIR /app
 
diff --git a/microservices/services/auth/Dockerfile b/microservices/services/auth/Dockerfile
index 1b3016f..0154ac4 100644
--- a/microservices/services/auth/Dockerfile
+++ b/microservices/services/auth/Dockerfile
@@ -24,12 +24,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 
 # Run the auth-service on a pinned Alpine image as an unprivileged user.
 # Configuration is environment-only; migrations are owned by the monolith.
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY auth/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 
 WORKDIR /app
 
diff --git a/microservices/services/bpm/Dockerfile b/microservices/services/bpm/Dockerfile
index 8364078..5537379 100644
--- a/microservices/services/bpm/Dockerfile
+++ b/microservices/services/bpm/Dockerfile
@@ -16,12 +16,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     go build -trimpath -o main ./cmd/main.go
 
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY bpm/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 WORKDIR /app
 RUN apk add --no-cache tzdata wget \
     && addgroup -S app && adduser -S app -G app \
diff --git a/microservices/services/file/Dockerfile b/microservices/services/file/Dockerfile
index 1b6c1cd..fb058e4 100644
--- a/microservices/services/file/Dockerfile
+++ b/microservices/services/file/Dockerfile
@@ -24,12 +24,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 
 # Run the file-service on a pinned Alpine image as an unprivileged user.
 # Configuration is environment-only; migrations are owned by the monolith.
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY file/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 
 WORKDIR /app
 
diff --git a/microservices/services/identity/Dockerfile b/microservices/services/identity/Dockerfile
index 6c65734..384b242 100644
--- a/microservices/services/identity/Dockerfile
+++ b/microservices/services/identity/Dockerfile
@@ -24,12 +24,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 
 # Run the identity-service on a pinned Alpine image as an unprivileged user.
 # Configuration is environment-only; migrations are owned by the monolith.
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY identity/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 
 WORKDIR /app
 
diff --git a/microservices/services/monitor/Dockerfile b/microservices/services/monitor/Dockerfile
index 5e6de06..5f2af26 100644
--- a/microservices/services/monitor/Dockerfile
+++ b/microservices/services/monitor/Dockerfile
@@ -25,13 +25,13 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     && go build -trimpath -o migrate ./cmd/migrate
 
 # Run the backend on a pinned Alpine image as an unprivileged user.
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY monitor/.bin/main /app/main
 COPY monitor/.bin/migrate /app/migrate
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 
 WORKDIR /app
 
diff --git a/microservices/services/system/Dockerfile b/microservices/services/system/Dockerfile
index 5c221b6..efbf5ee 100644
--- a/microservices/services/system/Dockerfile
+++ b/microservices/services/system/Dockerfile
@@ -24,7 +24,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 
 # 预检与 ZIP 只需要这些接入源文件；快照在构建时固化，不挂载宿主仓库。
 # 独立成阶段（不放 builder 里）：prebuilt 快路径也要快照，但不该为它触发容器内编译。
-FROM alpine:3.20 AS snapshot
+FROM alpine:3.24 AS snapshot
 COPY services/system/internal/api/routes.go /repository-snapshot/microservices/services/system/internal/api/routes.go
 COPY web/src/router/index.tsx /repository-snapshot/microservices/web/src/router/index.tsx
 COPY web/src/layouts/MainLayout.tsx /repository-snapshot/microservices/web/src/layouts/MainLayout.tsx
@@ -33,12 +33,12 @@ COPY services/monitor/migrations/ /repository-snapshot/microservices/services/mo
 
 # Run the system-service on a pinned Alpine image as an unprivileged user.
 # Configuration is environment-only; migrations are owned by the monolith.
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY services/system/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 
 WORKDIR /app