diff --git a/apps/wasmd/Dockerfile b/apps/wasmd/Dockerfile
index 7c5591a..5715b80 100644
--- a/apps/wasmd/Dockerfile
+++ b/apps/wasmd/Dockerfile
@@ -27,7 +27,7 @@ RUN echo "Ensuring binary is statically linked ..." \
   && (file /code/build/wasmd | grep "statically linked")
 
 # --------------------------------------------------------
-FROM docker.io/library/alpine:3.18
+FROM docker.io/library/alpine:3.20@sha256:1e42bbe2508154c9126d48c2b8a75420c3544343bf86fd041fb7527e017a4b4a
 
 # trunk-ignore(hadolint/DL3018)
 RUN apk add --no-cache \