diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 34408144..f469f69c 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -110,6 +110,9 @@ dockers_v2:
     platforms:
       - linux/amd64
       - linux/arm64
+    flags:
+      - "--pull=true"
+      - "--no-cache=true"
     labels:
       "org.opencontainers.image.authors": "Pocket ID"
       "org.opencontainers.image.url": "https://github.com/pocket-id/pocket-id"
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 2dbf0eca..7d88ba23 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -51,7 +51,8 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 FROM alpine:3.24.1
 WORKDIR /app
 
-RUN apk add --no-cache su-exec
+RUN apk upgrade --no-cache && \
+  apk add --no-cache su-exec
 
 COPY --from=backend-builder /build/pocket-id /app/pocket-id
 COPY ./scripts/docker /app/docker
diff --git a/docker/Dockerfile-prebuilt b/docker/Dockerfile-prebuilt
index 156c8ab2..31d3b2e0 100644
--- a/docker/Dockerfile-prebuilt
+++ b/docker/Dockerfile-prebuilt
@@ -9,7 +9,8 @@ ARG TARGETVARIANT
 
 WORKDIR /app
 
-RUN apk add --no-cache su-exec
+RUN apk upgrade --no-cache && \
+  apk add --no-cache su-exec
 
 COPY linux/${TARGETARCH}/${TARGETVARIANT}/pocket-id /app/pocket-id
 COPY ./scripts/docker /app/docker