diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1fa2263434f..7867a62aa9f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -35,6 +35,7 @@ querier:
 * [CHANGE] TraceQL: Add range condition for byte predicates [#4198](https://github.com/grafana/tempo/pull/4198) (@ie-pham)
 * [CHANGE] Return 422 for TRACE_TOO_LARGE queries [#4160](https://github.com/grafana/tempo/pull/4160) (@zalegrala)
 * [CHANGE] Upgrade OTEL sdk to reduce allocs [#4243](https://github.com/grafana/tempo/pull/4243) (@joe-elliott)
+* [CHANGE] Update Alpine image version to 3.21 [#4504](https://github.com/grafana/tempo/pull/4504) (@mdisibio)
 * [CHANGE] Tighten file permissions [#4251](https://github.com/grafana/tempo/pull/4251) (@zalegrala)
 * [CHANGE] Drop max live traces log message and rate limit trace too large. [#4418](https://github.com/grafana/tempo/pull/4418) (@joe-elliott)
 * [CHANGE] Update the Open-Telemetry dependencies to v0.116.0 [#4466](https://github.com/grafana/tempo/pull/4466) (@yvrhdn)
diff --git a/cmd/tempo-cli/Dockerfile b/cmd/tempo-cli/Dockerfile
index f54e475f717..1b2082460c0 100644
--- a/cmd/tempo-cli/Dockerfile
+++ b/cmd/tempo-cli/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.20 as certs
+FROM alpine:3.21 as certs
 RUN apk --update add ca-certificates
 ARG TARGETARCH
 COPY bin/linux/tempo-cli-${TARGETARCH} /tempo-cli
diff --git a/cmd/tempo-query/Dockerfile b/cmd/tempo-query/Dockerfile
index 44b473c1698..46336aca7ba 100644
--- a/cmd/tempo-query/Dockerfile
+++ b/cmd/tempo-query/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.20 as certs
+FROM alpine:3.21 as certs
 RUN apk --update add ca-certificates
 ARG TARGETARCH
 COPY bin/linux/tempo-query-${TARGETARCH} /tempo-query
diff --git a/cmd/tempo-serverless/cloud-run/Dockerfile b/cmd/tempo-serverless/cloud-run/Dockerfile
index a79ceef06bd..9c7370c42b5 100644
--- a/cmd/tempo-serverless/cloud-run/Dockerfile
+++ b/cmd/tempo-serverless/cloud-run/Dockerfile
@@ -9,7 +9,7 @@
 # build the serverless container image
 #
 #  todo: FROM scratch saves ~5MB which could be meaningful in a serverless setting, but using scratch gave strange errors on query.
-FROM alpine:3.20 as certs
+FROM alpine:3.21 as certs
 RUN apk --update add ca-certificates
 COPY ./main /main
 ENTRYPOINT ["/main"]
diff --git a/cmd/tempo-vulture/Dockerfile b/cmd/tempo-vulture/Dockerfile
index 6a7eb449861..9a4f611cec5 100644
--- a/cmd/tempo-vulture/Dockerfile
+++ b/cmd/tempo-vulture/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.20 as certs
+FROM alpine:3.21 as certs
 RUN apk --update add ca-certificates
 ARG TARGETARCH
 COPY bin/linux/tempo-vulture-${TARGETARCH} /tempo-vulture
diff --git a/cmd/tempo/Dockerfile b/cmd/tempo/Dockerfile
index 8e77d926244..395d7992424 100644
--- a/cmd/tempo/Dockerfile
+++ b/cmd/tempo/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.20 AS certs
+FROM alpine:3.21 AS certs
 RUN apk --update add ca-certificates
 ARG TARGETARCH
 COPY bin/linux/tempo-${TARGETARCH} /tempo
diff --git a/cmd/tempo/Dockerfile_debug b/cmd/tempo/Dockerfile_debug
index 04311bdf43f..687427fb9a5 100644
--- a/cmd/tempo/Dockerfile_debug
+++ b/cmd/tempo/Dockerfile_debug
@@ -2,7 +2,7 @@ FROM golang:alpine AS build-dlv
 
 RUN go install github.com/go-delve/delve/cmd/dlv@latest
 
-FROM alpine:3.20 as certs
+FROM alpine:3.21 as certs
 RUN apk --update add ca-certificates bash
 ARG TARGETARCH
 COPY bin/linux/tempo-${TARGETARCH} /tempo