diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9eea16d..7fd032c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,10 @@ Notable changes to ktms-admin. The format follows
 
 ## [Unreleased]
 
+### Security
+- The image is built on Alpine 3.23 with `ca-certificates` 20261020 or newer, which no longer
+  trusts the eMudhra intermediates whose keys leaked in October 2026, and with Go 1.27.3.
+
 ## [1.1.0] - 2026-10-24
 
 ### Added
diff --git a/Dockerfile b/Dockerfile
index 6659994..b8b1a9b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine AS builder
+FROM golang:1.27.3-alpine3.23 AS builder
 ARG TARGETOS=linux
 ARG TARGETARCH
 WORKDIR /app
@@ -8,9 +8,10 @@ COPY . .
 RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build \
     CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -trimpath -ldflags="-s -w" -o /out/ktms-admin ./cmd/ktms-admin
 
-FROM alpine:3.21
-# CA certificates are needed to reach identity providers for sign-in.
-RUN apk add --no-cache ca-certificates && adduser -D -u 10001 appuser
+FROM alpine:3.23
+# CA certificates are needed to reach identity providers for sign-in; 20261020 distrusts the
+# eMudhra intermediates whose keys leaked.
+RUN apk add --no-cache 'ca-certificates>=20261020-r0' && adduser -D -u 10001 appuser
 COPY --from=builder /out/ktms-admin /ktms-admin
 USER appuser
 EXPOSE 8080