diff --git a/ALPINE.txt b/ALPINE.txt
new file mode 100644
index 000000000..1bc446c8a
--- /dev/null
+++ b/ALPINE.txt
@@ -0,0 +1 @@
+3.16
\ No newline at end of file
diff --git a/cmd/printdep/printdep.go b/cmd/printdep/printdep.go
index 05395ee01..7d5e51a2a 100644
--- a/cmd/printdep/printdep.go
+++ b/cmd/printdep/printdep.go
@@ -19,10 +19,15 @@ import (
 var (
 	goToolchain    = flag.Bool("go", false, "print the supported Go toolchain git hash (a github.com/tailscale/go commit)")
 	goToolchainURL = flag.Bool("go-url", false, "print the URL to the tarball of the Tailscale Go toolchain")
+	alpine         = flag.Bool("alpine", false, "print the tag of alpine docker image")
 )
 
 func main() {
 	flag.Parse()
+	if *alpine {
+		fmt.Println(strings.TrimSpace(ts.AlpineDockerTag))
+		return
+	}
 	if *goToolchain {
 		fmt.Println(strings.TrimSpace(ts.GoToolchainRev))
 	}
diff --git a/version-embed.go b/version-embed.go
index ba5a2abef..af9d5dd08 100644
--- a/version-embed.go
+++ b/version-embed.go
@@ -10,6 +10,9 @@ import _ "embed"
 //go:embed VERSION.txt
 var Version string
 
+//go:embed ALPINE.txt
+var AlpineDockerTag string
+
 // GoToolchainRev is the git hash from github.com/tailscale/go that this release
 // should be built using. It may end in a newline.
 //
diff --git a/version/version_test.go b/version/version_test.go
new file mode 100644
index 000000000..38a2ae7c2
--- /dev/null
+++ b/version/version_test.go
@@ -0,0 +1,42 @@
+// Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package version
+
+import (
+	"bytes"
+	"os"
+	"testing"
+
+	ts "tailscale.com"
+)
+
+func TestAlpineTag(t *testing.T) {
+	if tag := readAlpineTag(t, "../Dockerfile.base"); tag == "" {
+		t.Fatal(`"FROM alpine:" not found in Dockerfile.base`)
+	} else if tag != ts.AlpineDockerTag {
+		t.Errorf("alpine version mismatch: Dockerfile.base has %q; ALPINE.txt has %q", tag, ts.AlpineDockerTag)
+	}
+	if tag := readAlpineTag(t, "../Dockerfile"); tag == "" {
+		t.Fatal(`"FROM alpine:" not found in Dockerfile`)
+	} else if tag != ts.AlpineDockerTag {
+		t.Errorf("alpine version mismatch: Dockerfile has %q; ALPINE.txt has %q", tag, ts.AlpineDockerTag)
+	}
+}
+
+func readAlpineTag(t *testing.T, file string) string {
+	f, err := os.ReadFile(file)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, line := range bytes.Split(f, []byte{'\n'}) {
+		line = bytes.TrimSpace(line)
+		_, suf, ok := bytes.Cut(line, []byte("FROM alpine:"))
+		if !ok {
+			continue
+		}
+		return string(suf)
+	}
+	return ""
+}