diff --git a/.docker/Dockerfile.alpine b/.docker/Dockerfile.alpine
index 5d3f6342..9dad926f 100644
--- a/.docker/Dockerfile.alpine
+++ b/.docker/Dockerfile.alpine
@@ -82,10 +82,12 @@ ARG ARCH
 RUN wget -O - https://github.com/upx/upx/releases/download/v5.0.0/upx-5.0.0-$(bash -c "echo \${0//v8/}" $ARCH)_linux.tar.xz | tar -xJf - -C /usr/local/bin --strip-components=1 --wildcards "*/upx"
 RUN pip3 install --break-system-packages --root-user-action ignore mistletoe
 RUN git config --global --add safe.directory /workspace
-COPY install-static-libs.sh /usr/local/bin/install-static-libs.sh
-RUN bash /usr/local/bin/install-static-libs.sh gcc clang-18 :alpine
 COPY install-mold.sh /usr/local/bin/install-mold.sh
 RUN bash /usr/local/bin/install-mold.sh
+COPY install-bloaty.sh /usr/local/bin/install-bloaty.sh
+RUN bash /usr/local/bin/install-bloaty.sh
+COPY install-static-libs.sh /usr/local/bin/install-static-libs.sh
+RUN bash /usr/local/bin/install-static-libs.sh gcc clang-18 :alpine
 RUN adduser -G users -s bash -u 1000 -D mhx
 USER mhx
 ENTRYPOINT /workspace/.docker/build-linux.sh
diff --git a/.docker/install-bloaty.sh b/.docker/install-bloaty.sh
new file mode 100644
index 00000000..aad8007e
--- /dev/null
+++ b/.docker/install-bloaty.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -ex
+
+cd "$HOME"
+mkdir pkgs
+cd pkgs
+
+git clone --recurse-submodules https://github.com/google/bloaty
+cd bloaty
+mkdir build
+cd build
+
+cmake .. -GNinja -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr/local
+ninja
+ninja install
+
+cd "$HOME"
+rm -rf pkgs
diff --git a/.docker/install-static-libs.sh b/.docker/install-static-libs.sh
index 7fb31189..bb300304 100644
--- a/.docker/install-static-libs.sh
+++ b/.docker/install-static-libs.sh
@@ -18,7 +18,7 @@ FLAC_VERSION=1.5.0
 # TODO: https://github.com/libunwind/libunwind/issues/702
 LIBUNWIND_VERSION=1.7.2
 BENCHMARK_VERSION=1.9.1
-OPENSSL_VERSION=3.0.16
+OPENSSL_VERSION=3.3.3
 CPPTRACE_VERSION=0.8.2
 DOUBLE_CONVERSION_VERSION=3.3.1
 FMT_VERSION=11.1.4
@@ -32,7 +32,7 @@ echo "Using $GCC and $CLANG"
 if [[ "$PKGS" == ":ubuntu" ]]; then
     PKGS="file,bzip2,libarchive,flac,libunwind,benchmark,openssl,cpptrace"
 elif [[ "$PKGS" == ":alpine" ]]; then
-    PKGS="benchmark,brotli,cpptrace,double-conversion,flac,fmt,glog,libarchive,lz4,xxhash"
+    PKGS="benchmark,brotli,bzip2,cpptrace,double-conversion,flac,fmt,glog,libarchive,lz4,openssl,xxhash"
     export CFLAGS="-Os -ffunction-sections -fdata-sections -fmerge-all-constants"
     export CXXFLAGS="$CFLAGS"
 elif [[ "$PKGS" == ":none" ]]; then
@@ -141,7 +141,12 @@ for COMPILER in clang gcc; do
         cd "$HOME/pkgs/$COMPILER"
         tar xf ../${OPENSSL_TARBALL}
         cd openssl-${OPENSSL_VERSION}
-        ./Configure --prefix="$INSTALL_DIR" --libdir=lib threads no-fips no-shared no-pic no-dso
+        ./Configure --prefix="$INSTALL_DIR" --libdir=lib threads no-fips no-shared no-pic no-dso no-aria no-async no-atexit \
+                no-autoload-config no-blake2 no-bf no-camellia no-cast no-chacha no-cmac no-cms no-cmp no-comp no-ct no-des \
+                no-dgram no-dh no-dsa no-ec no-engine no-filenames no-idea no-ktls no-md4 no-multiblock \
+                no-nextprotoneg no-ocsp no-ocb no-poly1305 no-psk no-rc2 no-rc4 no-seed no-siphash no-siv no-sm3 no-sm4 \
+                no-srp no-srtp no-ssl3-method no-ssl-trace no-tfo no-ts no-ui-console no-whirlpool no-fips-securitychecks
+
         make -j$(nproc)
         make install_sw
     fi