diff --git a/Dockerfile.integration b/Dockerfile.integration
index 3916f140..341067e5 100644
--- a/Dockerfile.integration
+++ b/Dockerfile.integration
@@ -24,7 +24,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build -gcflags="all=-N -l" -o /go/bin/headscale
 FROM debian:trixie-slim
 
 RUN apt-get --update install --no-install-recommends --yes \
-    less jq sqlite3 dnsutils ca-certificates procps bash findutils curl traceroute python3 \
+    bash ca-certificates curl dnsutils findutils iproute2 jq less procps python3 sqlite3 \
   && apt-get dist-clean
 
 RUN mkdir -p /var/run/headscale
diff --git a/Dockerfile.integration-ci b/Dockerfile.integration-ci
index d0907714..e55ab7b9 100644
--- a/Dockerfile.integration-ci
+++ b/Dockerfile.integration-ci
@@ -4,7 +4,7 @@
 FROM debian:trixie-slim
 
 RUN apt-get --update install --no-install-recommends --yes \
-    less jq sqlite3 dnsutils ca-certificates procps bash findutils curl traceroute \
+    bash ca-certificates curl dnsutils findutils iproute2 jq less procps python3 sqlite3 \
   && apt-get dist-clean
 
 RUN mkdir -p /var/run/headscale
diff --git a/Dockerfile.tailscale-HEAD b/Dockerfile.tailscale-HEAD
index 2df355d6..96edf72c 100644
--- a/Dockerfile.tailscale-HEAD
+++ b/Dockerfile.tailscale-HEAD
@@ -37,7 +37,9 @@ RUN GOARCH=$TARGETARCH go install -tags="${BUILD_TAGS}" -ldflags="\
       -v ./cmd/tailscale ./cmd/tailscaled ./cmd/containerboot
 
 FROM alpine:3.22
-RUN apk add --no-cache ca-certificates iptables iproute2 ip6tables curl traceroute
+# Upstream: ca-certificates ip6tables iptables iproute2
+# Tests: curl python3 (traceroute via BusyBox)
+RUN apk add --no-cache ca-certificates curl ip6tables iptables iproute2 python3
 
 COPY --from=build-env /go/bin/* /usr/local/bin/
 # For compat with the previous run.sh, although ideally you should be