diff --git a/core/base/Dockerfile b/core/base/Dockerfile
index 68febcd6..50d1f49a 100644
--- a/core/base/Dockerfile
+++ b/core/base/Dockerfile
@@ -3,7 +3,7 @@
 # base system image (intermediate)
 # Note when updating the alpine tag, first manually run the workflow .github/workflows/mirror.yml.
 # Just run the workflow with the tag that must be synchronised.
-ARG DISTRO=ghcr.io/mailu/alpine:3.17.2
+ARG DISTRO=ghcr.io/mailu/alpine:3.18.4
 FROM $DISTRO as system
 
 ENV TZ=Etc/UTC LANG=C.UTF-8
diff --git a/towncrier/newsfragments/2934.bugfix b/towncrier/newsfragments/2934.bugfix
new file mode 100644
index 00000000..349bc8e1
--- /dev/null
+++ b/towncrier/newsfragments/2934.bugfix
@@ -0,0 +1,3 @@
+Upgrade to alpine 3.18.4: this will fix a bug whereby musl wasn't retrying using TCP when it received truncated DNS replies from its upstream. In practice, this has been seen in the wild when postfix complains of:
+
+"Host or domain name not found. Name service error for name=outlook-com.olc.protection.outlook.com type=AAAA: Host found but no data record of requested type"