diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 7e102775..7099b790 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1 +1,4 @@
-* @jrwbabylonlab @jeremy-babylonlabs @kirugan
\ No newline at end of file
+* @jrwbabylonlab @jeremy-babylonlabs @kirugan
+
+# DevOps team owns CI/CD workflows
+/.github/workflows/ @babylonlabs-io/devops
\ No newline at end of file
diff --git a/contrib/images/staking-api-service/Dockerfile b/contrib/images/staking-api-service/Dockerfile
index 4524924e..bd19bdfa 100644
--- a/contrib/images/staking-api-service/Dockerfile
+++ b/contrib/images/staking-api-service/Dockerfile
@@ -2,6 +2,7 @@ FROM golang:1.24.11-alpine AS builder
 
 ARG VERSION="HEAD"
 
+# hadolint ignore=DL3018
 RUN apk add --no-cache  \
     make \
     git \
@@ -31,10 +32,10 @@ RUN LDFLAGS='-extldflags "-static" -v' \
     make build
 
 # Final minimal image with binary only
-FROM alpine:3.16 AS run
+FROM alpine:3.21 AS run
 
 RUN addgroup --gid 1138 -S staking-api-service && adduser --uid 1138 -S staking-api-service -G staking-api-service
-RUN apk add bash curl jq
+RUN apk add --no-cache bash=5.2.37-r0 curl=8.14.1-r2 jq=1.7.1-r0
 
 # Label should match your github repo
 LABEL org.opencontainers.image.source="https://github.com/babylonlabs-io/staking-api-service:${VERSION}"