diff --git a/rust/Dockerfile b/rust/Dockerfile
index c5aaca0c3..7c081de9d 100644
--- a/rust/Dockerfile
+++ b/rust/Dockerfile
@@ -1,31 +1,28 @@
 # Global args to use in build commands
-ARG DEBIAN_VERSION="12-slim"
+ARG ALPINE_VERSION="3.19"
 ARG CARGO_CHEF_VERSION="0.1.62"
 ARG RUSTUP_VERSION="1.26.0"
 ARG RUSTUP_x86_DOWNLOAD_SHA256="7aa9e2a380a9958fc1fc426a3323209b2c86181c6816640979580f62ff7d48d4"
 ARG RUSTUP_aarch64_DOWNLOAD_SHA256="b1962dfc18e1fd47d01341e6897cace67cddfabf547ef394e8883939bd6e002e"
 ARG RUST_VERSION="1.74.1"
 
-FROM debian:${DEBIAN_VERSION} as rust
+FROM alpine:${ALPINE_VERSION} as rust
 
 # Important!  Update this no-op ENV variable when this Dockerfile
 # is updated with the current date. It will force refresh of all
 # of the base images and things like `apk add` won't be using
 # old cached versions when the Dockerfile is built.
 ENV REFRESHED_AT=2023-12-11 \
-  DEBIAN_FRONTEND=noninteractive \
   LANG=C.UTF-8 \
   TERM=xterm
 
 RUN set -xe \
-  # Upgrade Debian and base packages
-  && apt-get update -qq \
+  # Upgrade Alpine and base packages
+  && apk --no-cache --update-cache --available upgrade \
   # Install required deps
-  && apt-get install -y --no-install-recommends \
+  && apk add --no-cache --update-cache \
   ca-certificates \
-  curl \
-  gcc \
-  libc6-dev
+  gcc
 
 ENV RUSTUP_HOME=/usr/local/rustup \
   CARGO_HOME=/usr/local/cargo \
@@ -36,17 +33,17 @@ ARG RUSTUP_x86_DOWNLOAD_SHA256
 ARG RUSTUP_aarch64_DOWNLOAD_SHA256
 ARG RUST_VERSION
 RUN set -eux; \
-  arch="$(uname -m)"; \
-  case "$arch" in \
-  x86_64) rustTarget='x86_64-unknown-linux-musl'; rustupSha256=${RUSTUP_x86_DOWNLOAD_SHA256} ;; \
-  aarch64) rustTarget='aarch64-unknown-linux-musl'; rustupSha256=${RUSTUP_aarch64_DOWNLOAD_SHA256} ;; \
-  *) echo >&2 "unsupported architecture: $arch"; exit 1 ;; \
+  apkArch="$(apk --print-arch)"; \
+  case "$apkArch" in \
+  x86_64) rustArch='x86_64-unknown-linux-musl'; rustupSha256=${RUSTUP_x86_DOWNLOAD_SHA256} ;; \
+  aarch64) rustArch='aarch64-unknown-linux-musl'; rustupSha256=${RUSTUP_aarch64_DOWNLOAD_SHA256} ;; \
+  *) echo >&2 "unsupported architecture: $apkArch"; exit 1 ;; \
   esac; \
-  url="https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/${rustTarget}/rustup-init"; \
-  curl "$url" -O; \
+  url="https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/${rustArch}/rustup-init"; \
+  wget "$url"; \
   echo "${rustupSha256} *rustup-init" | sha256sum -c -; \
   chmod +x rustup-init; \
-  ./rustup-init -y --no-modify-path --profile minimal --default-toolchain ${RUST_VERSION} --default-host ${rustTarget}; \
+  ./rustup-init -y --no-modify-path --profile minimal --default-toolchain ${RUST_VERSION} --default-host ${rustArch}; \
   rm rustup-init; \
   chmod -R a+w $RUSTUP_HOME $CARGO_HOME; \
   rustup --version; \
@@ -58,6 +55,7 @@ FROM rust as chef
 
 ARG CARGO_CHEF_VERSION
 RUN set -xe \
+  && apk add --no-cache musl-dev  \
   && cargo install cargo-chef --locked --version=${CARGO_CHEF_VERSION} \
   && rm -rf $CARGO_HOME/registry/
 
@@ -92,14 +90,13 @@ ARG PACKAGE
 RUN cargo build -p ${PACKAGE} $([ -n "${TARGET}" ] && "--target ${TARGET}")
 
 # Image which is used to run the application binary
-FROM debian:${DEBIAN_VERSION} AS runtime
+FROM alpine:${ALPINE_VERSION} AS runtime
 
 # Important!  Update this no-op ENV variable when this Dockerfile
 # is updated with the current date. It will force refresh of all
 # of the base images and things like `apk add` won't be using
 # old cached versions when the Dockerfile is built.
 ENV REFRESHED_AT=2023-10-23 \
-  DEBIAN_FRONTEND=noninteractive \
   LANG=C.UTF-8 \
   TERM=xterm \
   RUST_BACKTRACE=1
@@ -108,17 +105,14 @@ WORKDIR /bin
 
 ## curl is needed by the entrypoint script
 RUN set -xe \
-  && apt-get update -qq \
-  && apt-get install -y --no-install-recommends curl
+  && apk add --no-cache curl
 
 COPY ./docker-init.sh .
 
 ## iptables are needed only by gateway for masquerading
 ARG PACKAGE
 RUN set -xe \
-  && \[ "${PACKAGE}" = "firezone-gateway" ] \
-  && apt-get update -qq \
-  && apt-get install -y --no-install-recommends iptables || true
+  && \[ "${PACKAGE}" = "firezone-gateway" ] && apk add --no-cache iptables ip6tables || true
 
 ENTRYPOINT ["docker-init.sh"]
 
@@ -130,8 +124,7 @@ CMD $PACKAGE
 FROM runtime AS debug
 
 RUN set -xe \
-  && apt-get update -qq \
-  && apt-get install -y --no-install-recommends iperf3
+  && apk add --no-cache iperf3
 
 ARG TARGET
 COPY --from=builder /build/target/${TARGET}/debug/${PACKAGE} .