diff --git a/microservices/services/ai/Dockerfile b/microservices/services/ai/Dockerfile
index 268d02af..d38b6c86 100644
--- a/microservices/services/ai/Dockerfile
+++ b/microservices/services/ai/Dockerfile
@@ -22,12 +22,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 
 # Run the ai-service on a pinned Alpine image as an unprivileged user.
 # Configuration is environment-only; migrations are owned by the monolith.
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY ai/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 
 WORKDIR /app
 
diff --git a/microservices/services/audit/Dockerfile b/microservices/services/audit/Dockerfile
index 4b058f65..adb44fd3 100644
--- a/microservices/services/audit/Dockerfile
+++ b/microservices/services/audit/Dockerfile
@@ -22,12 +22,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 
 # Run the audit-service on a pinned Alpine image as an unprivileged user.
 # Configuration is environment-only; migrations are owned by the monolith.
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY audit/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 
 WORKDIR /app
 
diff --git a/microservices/services/auth/Dockerfile b/microservices/services/auth/Dockerfile
index a4964d93..e3123c30 100644
--- a/microservices/services/auth/Dockerfile
+++ b/microservices/services/auth/Dockerfile
@@ -22,12 +22,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 
 # Run the auth-service on a pinned Alpine image as an unprivileged user.
 # Configuration is environment-only; migrations are owned by the monolith.
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY auth/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 
 WORKDIR /app
 
diff --git a/microservices/services/bpm/Dockerfile b/microservices/services/bpm/Dockerfile
index 3c9a93ae..742766de 100644
--- a/microservices/services/bpm/Dockerfile
+++ b/microservices/services/bpm/Dockerfile
@@ -14,12 +14,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     go build -trimpath -o main ./bpm/cmd/main.go
 
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY bpm/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 WORKDIR /app
 RUN apk add --no-cache tzdata wget \
     && addgroup -S app && adduser -S app -G app \
diff --git a/microservices/services/cc/Dockerfile b/microservices/services/cc/Dockerfile
index 8f7621c5..a432ac9d 100644
--- a/microservices/services/cc/Dockerfile
+++ b/microservices/services/cc/Dockerfile
@@ -14,12 +14,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     go build -trimpath -o main ./cc/cmd/main.go
 
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY cc/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 WORKDIR /app
 RUN apk add --no-cache tzdata wget ffmpeg \
     && addgroup -S app && adduser -S app -G app \
diff --git a/microservices/services/crm/Dockerfile b/microservices/services/crm/Dockerfile
index 827d9afb..a150cc35 100644
--- a/microservices/services/crm/Dockerfile
+++ b/microservices/services/crm/Dockerfile
@@ -14,12 +14,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     go build -trimpath -o main ./crm/cmd/main.go
 
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY crm/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 WORKDIR /app
 RUN apk add --no-cache tzdata wget \
     && addgroup -S app && adduser -S app -G app \
diff --git a/microservices/services/file/Dockerfile b/microservices/services/file/Dockerfile
index 51b9ea84..43dde3a3 100644
--- a/microservices/services/file/Dockerfile
+++ b/microservices/services/file/Dockerfile
@@ -22,12 +22,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 
 # Run the file-service on a pinned Alpine image as an unprivileged user.
 # Configuration is environment-only; migrations are owned by the monolith.
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY file/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 
 WORKDIR /app
 
diff --git a/microservices/services/identity/Dockerfile b/microservices/services/identity/Dockerfile
index 6f5c7ed1..b7ed1174 100644
--- a/microservices/services/identity/Dockerfile
+++ b/microservices/services/identity/Dockerfile
@@ -22,12 +22,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 
 # Run the identity-service on a pinned Alpine image as an unprivileged user.
 # Configuration is environment-only; migrations are owned by the monolith.
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY identity/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 
 WORKDIR /app
 
diff --git a/microservices/services/im/Dockerfile b/microservices/services/im/Dockerfile
index 2e9e6b35..5ff27ee5 100644
--- a/microservices/services/im/Dockerfile
+++ b/microservices/services/im/Dockerfile
@@ -14,12 +14,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     go build -trimpath -o main ./im/cmd/main.go
 
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY im/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 WORKDIR /app
 RUN apk add --no-cache tzdata wget \
     && addgroup -S app && adduser -S app -G app \
diff --git a/microservices/services/monitor/Dockerfile b/microservices/services/monitor/Dockerfile
index 9e1207ad..0a3354a8 100644
--- a/microservices/services/monitor/Dockerfile
+++ b/microservices/services/monitor/Dockerfile
@@ -21,13 +21,13 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     && go build -trimpath -o migrate ./monitor/cmd/migrate
 
 # Run the backend on a pinned Alpine image as an unprivileged user.
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY monitor/.bin/main /app/main
 COPY monitor/.bin/migrate /app/migrate
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 
 WORKDIR /app
 
diff --git a/microservices/services/mp/Dockerfile b/microservices/services/mp/Dockerfile
index 15527eb6..acd46444 100644
--- a/microservices/services/mp/Dockerfile
+++ b/microservices/services/mp/Dockerfile
@@ -14,12 +14,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     go build -trimpath -o main ./mp/cmd/main.go
 
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY mp/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 WORKDIR /app
 RUN apk add --no-cache tzdata wget \
     && addgroup -S app && adduser -S app -G app \
diff --git a/microservices/services/notify/Dockerfile b/microservices/services/notify/Dockerfile
index a2fb771e..6aee1596 100644
--- a/microservices/services/notify/Dockerfile
+++ b/microservices/services/notify/Dockerfile
@@ -14,12 +14,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     go build -trimpath -o main ./notify/cmd/main.go
 
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY notify/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 WORKDIR /app
 RUN apk add --no-cache tzdata wget \
     && addgroup -S app && adduser -S app -G app \
diff --git a/microservices/services/pay/Dockerfile b/microservices/services/pay/Dockerfile
index 15ce705b..7fd8588c 100644
--- a/microservices/services/pay/Dockerfile
+++ b/microservices/services/pay/Dockerfile
@@ -14,12 +14,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     go build -trimpath -o main ./pay/cmd/main.go
 
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY pay/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 WORKDIR /app
 RUN apk add --no-cache tzdata wget \
     && addgroup -S app && adduser -S app -G app \
diff --git a/microservices/services/system/Dockerfile b/microservices/services/system/Dockerfile
index 4f5b6cbe..bfeb2879 100644
--- a/microservices/services/system/Dockerfile
+++ b/microservices/services/system/Dockerfile
@@ -23,7 +23,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 
 # 预检与 ZIP 只需要这些接入源文件；快照在构建时固化，不挂载宿主仓库。
 # 独立成阶段（不放 builder 里）：prebuilt 快路径也要快照，但不该为它触发容器内编译。
-FROM alpine:3.20 AS snapshot
+FROM alpine:3.24 AS snapshot
 COPY services/system/internal/api/routes.go /repository-snapshot/microservices/services/system/internal/api/routes.go
 COPY web/src/router/index.tsx /repository-snapshot/microservices/web/src/router/index.tsx
 COPY web/src/layouts/menu-defs.tsx /repository-snapshot/microservices/web/src/layouts/menu-defs.tsx
@@ -32,12 +32,12 @@ COPY services/monitor/migrations/ /repository-snapshot/microservices/services/mo
 
 # Run the system-service on a pinned Alpine image as an unprivileged user.
 # Configuration is environment-only; migrations are owned by the monolith.
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY services/system/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 
 WORKDIR /app
 
diff --git a/microservices/services/ticket/Dockerfile b/microservices/services/ticket/Dockerfile
index 3ae80866..9165f1f7 100644
--- a/microservices/services/ticket/Dockerfile
+++ b/microservices/services/ticket/Dockerfile
@@ -14,12 +14,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     go build -trimpath -o main ./ticket/cmd/main.go
 
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY ticket/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 WORKDIR /app
 RUN apk add --no-cache tzdata wget \
     && addgroup -S app && adduser -S app -G app \
diff --git a/microservices/services/visibility/Dockerfile b/microservices/services/visibility/Dockerfile
index 0aac6c72..36f623d1 100644
--- a/microservices/services/visibility/Dockerfile
+++ b/microservices/services/visibility/Dockerfile
@@ -14,12 +14,12 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     go build -trimpath -o main ./visibility/cmd/main.go
 
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY visibility/.bin/main /app/main
 
 FROM ${MAIN_SRC} AS main-src
 
-FROM alpine:3.20
+FROM alpine:3.24
 WORKDIR /app
 RUN apk add --no-cache tzdata wget \
     && addgroup -S app && adduser -S app -G app \
diff --git a/microservices/web/Dockerfile b/microservices/web/Dockerfile
index 4af6ad0e..18075d7f 100644
--- a/microservices/web/Dockerfile
+++ b/microservices/web/Dockerfile
@@ -20,7 +20,7 @@ COPY . .
 
 RUN npm run build
 
-FROM alpine:3.20 AS prebuilt
+FROM alpine:3.24 AS prebuilt
 COPY .bin/html /app/dist
 
 FROM ${MAIN_SRC} AS assets