diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 6ad6f4e27d82b..f443ebf2b4473 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -231,7 +231,7 @@ jobs:
 
       - uses: hashicorp/setup-terraform@v2
         with:
-          terraform_version: 1.1.9
+          terraform_version: 1.5.1
           terraform_wrapper: false
 
       - name: Test with Mock Database
@@ -296,7 +296,7 @@ jobs:
 
       - uses: hashicorp/setup-terraform@v2
         with:
-          terraform_version: 1.1.9
+          terraform_version: 1.5.1
           terraform_wrapper: false
 
       - name: Test with PostgreSQL Database
@@ -338,6 +338,11 @@ jobs:
 
       - uses: ./.github/actions/setup-go
 
+      - uses: hashicorp/setup-terraform@v2
+        with:
+          terraform_version: 1.5.1
+          terraform_wrapper: false
+
       - name: Run Tests
         run: |
           gotestsum --junitfile="gotests.xml" -- -race ./...
@@ -474,7 +479,7 @@ jobs:
 
       - uses: hashicorp/setup-terraform@v2
         with:
-          terraform_version: 1.1.9
+          terraform_version: 1.5.1
           terraform_wrapper: false
 
       - name: Build
diff --git a/provisioner/terraform/install.go b/provisioner/terraform/install.go
index c1ba27fc0f2b4..c0be0ee6a67bb 100644
--- a/provisioner/terraform/install.go
+++ b/provisioner/terraform/install.go
@@ -22,7 +22,7 @@ var (
 	TerraformVersion = version.Must(version.NewVersion("1.4.6"))
 
 	minTerraformVersion = version.Must(version.NewVersion("1.1.0"))
-	maxTerraformVersion = version.Must(version.NewVersion("1.4.9"))
+	maxTerraformVersion = version.Must(version.NewVersion("1.5.9")) // use .9 to automatically allow patch releases
 
 	terraformMinorVersionMismatch = xerrors.New("Terraform binary minor version mismatch.")
 )
diff --git a/provisioner/terraform/provision_test.go b/provisioner/terraform/provision_test.go
index b274b547406e3..7879d30fc76ed 100644
--- a/provisioner/terraform/provision_test.go
+++ b/provisioner/terraform/provision_test.go
@@ -20,7 +20,6 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-
 	"github.com/coder/coder/provisioner/terraform"
 	"github.com/coder/coder/provisionersdk"
 	"github.com/coder/coder/provisionersdk/proto"
@@ -284,7 +283,7 @@ func TestProvision(t *testing.T) {
 			Files: map[string]string{
 				"main.tf": `a`,
 			},
-			ErrorContains:     "initialize terraform",
+			ErrorContains:     "plan terraform",
 			ExpectLogContains: "Argument or block definition required",
 		},
 		{
@@ -292,7 +291,7 @@ func TestProvision(t *testing.T) {
 			Files: map[string]string{
 				"main.tf": `;asdf;`,
 			},
-			ErrorContains:     "initialize terraform",
+			ErrorContains:     "plan terraform",
 			ExpectLogContains: `The ";" character is not valid.`,
 		},
 		{
diff --git a/scripts/Dockerfile.base b/scripts/Dockerfile.base
index 5dbbdb386696b..c24970ef2cac3 100644
--- a/scripts/Dockerfile.base
+++ b/scripts/Dockerfile.base
@@ -1,7 +1,7 @@
 # This is the base image used for Coder images. It's a multi-arch image that is
 # built in depot.dev for all supported architectures. Since it's built on real
 # hardware and not cross-compiled, it can have "RUN" commands.
-FROM alpine:3.18
+FROM alpine:3.18.2
 
 # We use a single RUN command to reduce the number of layers in the image.
 # NOTE: Keep the Terraform version in sync with minTerraformVersion and
@@ -11,9 +11,13 @@ RUN apk add --no-cache \
 		wget \
 		bash \
 		git \
-		openssl>=3.1.1-r1 \
-		openssh-client \
-		terraform=1.4.6-r1 && \
+		openssh-client && \
+	# Use the edge repo, since Terraform doesn't seem to be backported to 3.18.
+	# TODO: remove =~
+	# For some reason alpine's ARM builders are offline, so ARM builds will have
+	# to fall back to 1.5.0.
+	apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community \
+		terraform=~1.5-r0 && \
 	addgroup \
 		-g 1000 \
 		coder && \