diff --git a/.github/docker/alpine/Dockerfile b/.github/docker/alpine/Dockerfile
index f3943312b..bc29ae381 100644
--- a/.github/docker/alpine/Dockerfile
+++ b/.github/docker/alpine/Dockerfile
@@ -2,6 +2,9 @@
 ARG BASE=alpine:latest
 FROM ${BASE}
 
+ARG PIP_INSTALL=
+COPY requirements.txt /tmp/requirements.txt
+
 RUN apk add --no-cache \
     bash \
     build-base \
@@ -14,6 +17,7 @@ RUN apk add --no-cache \
     icu \
     linux-headers \
     lsb-release-minimal \
+    llvm \
     mitmproxy \
     moreutils \
     nodejs \
@@ -24,11 +28,28 @@ RUN apk add --no-cache \
     python3 \
     python3-dev \
     py3-pip \
+    rustup \
     sudo \
     tar \
     tree \
     wget
 
+# 3.23+
+RUN if awk -F. '{ exit !($1 > 3 || ($1 == 3 && $2 >= 23)) }' /etc/alpine-release; then \
+        (apk add --no-cache llvm22-libs || \
+            apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main llvm22-libs) && \
+        cargo install --locked --git https://github.com/aya-rs/bpf-linker --root /usr/local bpf-linker && \
+        RUSTUP_INIT_SKIP_PATH_CHECK=yes rustup-init -y --profile minimal --default-toolchain none && \
+        . /root/.cargo/env && \
+        rustup toolchain install nightly --profile minimal --component rust-src && \
+        ln -s /root/.cargo/bin/rustup /usr/local/bin/rustup && \
+        if [ -n "${PIP_INSTALL}" ]; then \
+            python3 -m pip install --break-system-packages --upgrade --constraint /tmp/requirements.txt ${PIP_INSTALL}; \
+        fi; \
+    fi
+ENV CARGO_HOME=/root/.cargo
+ENV RUSTUP_HOME=/root/.rustup
+
 RUN curl -sSL --retry 5 https://dot.net/v1/dotnet-install.sh | bash -eo pipefail /dev/stdin --channel 10.0 --install-dir /usr/share/dotnet
 RUN ln -s /usr/share/dotnet/dotnet /usr/local/bin/dotnet
 
diff --git a/.github/docker/alpine/requirements.txt b/.github/docker/alpine/requirements.txt
new file mode 100644
index 000000000..8b1378917
--- /dev/null
+++ b/.github/docker/alpine/requirements.txt
@@ -0,0 +1 @@
+
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d068c3ebc..261ef08b4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -142,13 +142,13 @@ jobs:
             RUN_ANALYZER: code-checker,valgrind
           - name: Linux (GCC + musl + libunwind)
             os: ubuntu-latest
-            container: ghcr.io/getsentry/sentry-native-alpine:3.21
+            container: ghcr.io/getsentry/sentry-native-alpine:3.23
             CC: gcc
             CXX: g++
             SYSTEM_PYTHON: 1
           - name: Linux (clang + musl + libunwind)
             os: ubuntu-latest
-            container: ghcr.io/getsentry/sentry-native-alpine:3.21
+            container: ghcr.io/getsentry/sentry-native-alpine:3.23
             CC: clang
             CXX: clang++
             SYSTEM_PYTHON: 1
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 2a3497603..e3474a8e4 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -6,6 +6,7 @@ on:
       - master
     paths:
       - '.github/docker/**'
+      - 'tests/requirements.txt'
   workflow_dispatch:
 
 jobs:
@@ -29,6 +30,11 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
 
+      - name: Copy test requirements
+        run: |
+          git update-index --assume-unchanged .github/docker/alpine/requirements.txt
+          cp tests/requirements.txt .github/docker/alpine/requirements.txt
+
       - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # pin@v4.1.0
         with:
           registry: ghcr.io
@@ -47,3 +53,4 @@ jobs:
           context: .github/docker/alpine
           build-args: |
             BASE=alpine:${{ matrix.version }}
+            PIP_INSTALL=${{ matrix.version == '3.23' && 'mitmproxy' || '' }}
diff --git a/tests/requirements.txt b/tests/requirements.txt
index 1c4d7d5bd..a75d1d9bc 100644
--- a/tests/requirements.txt
+++ b/tests/requirements.txt
@@ -7,7 +7,7 @@ pytest-xdist==3.8.0
 clang-format==20.1.5
 pywin32==308; sys_platform == "win32"
 # mitmproxy requires OpenSSL to build on Windows ARM64, skip it there
-mitmproxy==11.0.0; platform_machine != "ARM64"
+mitmproxy==12.2.2; platform_machine != "ARM64"
 psutil==7.1.1
 # For E2E tests that call Sentry API
 requests==2.33.0