diff --git a/Dockerfile b/Dockerfile
index b7f75fc..069cfae 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,8 @@
 ARG PHP_VERSION=8.5
 ARG PHP_API
+ARG ALPINE_VERSION=3.23
 
-FROM php:${PHP_VERSION}-cli-alpine AS trusted-base
+FROM php:${PHP_VERSION}-cli-alpine${ALPINE_VERSION} AS trusted-base
 
 # Distrust the compromised eMudhra chains before build-time or runtime HTTPS.
 RUN apk add --no-cache 'ca-certificates>=20261020-r0' 'ca-certificates-bundle>=20261020-r0' && \
diff --git a/versions/8.3.env b/versions/8.3.env
index c6c1427..962f9e8 100644
--- a/versions/8.3.env
+++ b/versions/8.3.env
@@ -1,4 +1,6 @@
 PHP_VERSION=8.3
+# Pinned: an unpinned tag follows the newest Alpine, and 3.24's erofs-utils 1.9.1 cannot extract fragments/dedupe images.
+ALPINE_VERSION=3.23
 PHP_API=20230831
 PHP_REDIS_VERSION=6.3.0
 PHP_SWOOLE_VERSION=v6.2.0
diff --git a/versions/8.4.env b/versions/8.4.env
index d9fca58..c0b6aea 100644
--- a/versions/8.4.env
+++ b/versions/8.4.env
@@ -1,4 +1,6 @@
 PHP_VERSION=8.4
+# Pinned: an unpinned tag follows the newest Alpine, and 3.24's erofs-utils 1.9.1 cannot extract fragments/dedupe images.
+ALPINE_VERSION=3.23
 PHP_API=20240924
 PHP_REDIS_VERSION=6.3.0
 PHP_SWOOLE_VERSION=v6.2.0
diff --git a/versions/8.5.env b/versions/8.5.env
index d63d4fc..d973204 100644
--- a/versions/8.5.env
+++ b/versions/8.5.env
@@ -1,4 +1,6 @@
 PHP_VERSION=8.5
+# Pinned: an unpinned tag follows the newest Alpine, and 3.24's erofs-utils 1.9.1 cannot extract fragments/dedupe images.
+ALPINE_VERSION=3.23
 PHP_API=20250925
 PHP_REDIS_VERSION=6.3.0
 PHP_SWOOLE_VERSION=v6.2.0