diff --git a/.github/workflows/buf-binary-size.yaml b/.github/workflows/buf-binary-size.yaml
new file mode 100644
index 0000000000..74cfc68df1
--- /dev/null
+++ b/.github/workflows/buf-binary-size.yaml
@@ -0,0 +1,31 @@
+name: binary-size
+on: push
+# Prevent writing to the repository using the CI token.
+# Ref: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#permissions
+permissions: read-all
+env:
+  MAKEFLAGS: "-j 2"
+jobs:
+  buf-binary-size:
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: setup-go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.21.x'
+      - name: cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/buf/${{ runner.os }}/x86_64/bin
+            ~/.cache/buf/${{ runner.os }}/x86_64/go/pkg/mod
+            ~/.cache/buf/${{ runner.os }}/x86_64/gocache
+            ~/.cache/buf/${{ runner.os }}/x86_64/include
+            ~/.cache/buf/${{ runner.os }}/x86_64/versions
+          key: ${{ runner.os }}-buf-${{ hashFiles('**/go.sum', 'make/**') }}
+          restore-keys: |
+            ${{ runner.os }}-buf-
+      - name: make-bufbinarysize
+        run: make bufbinarysize
diff --git a/Dockerfile.buf b/Dockerfile.buf
index 40409b988d..8559990a07 100644
--- a/Dockerfile.buf
+++ b/Dockerfile.buf
@@ -13,7 +13,7 @@ ARG TARGETARCH
 RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
   go build -ldflags "-s -w" -trimpath -buildvcs=false -o /go/bin/buf ./cmd/buf
 
-FROM --platform=${TARGETPLATFORM} alpine:3.19.0
+FROM --platform=${TARGETPLATFORM} alpine:3.19.1
 
 RUN apk add --update --no-cache \
     ca-certificates \
diff --git a/make/buf/all.mk b/make/buf/all.mk
index 4167a12f2e..825b47ac11 100644
--- a/make/buf/all.mk
+++ b/make/buf/all.mk
@@ -143,6 +143,10 @@ bufgeneratesteps:: \
 bufrelease: $(MINISIGN)
 	DOCKER_IMAGE=golang:1.21-bullseye bash make/buf/scripts/release.bash
 
+.PHONY: bufbinarysize
+bufbinarysize:
+	@bash make/buf/scripts/binarysize.bash ./cmd/buf
+
 .PHONY: updateversion
 updateversion:
 ifndef VERSION
diff --git a/make/buf/scripts/binarysize.bash b/make/buf/scripts/binarysize.bash
new file mode 100755
index 0000000000..7001065edf
--- /dev/null
+++ b/make/buf/scripts/binarysize.bash
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+set -eo pipefail
+
+DIR="$(CDPATH= cd "$(dirname "${0}")/../../.." && pwd)"
+cd "${DIR}"
+
+TMP="$(mktemp -d )"
+trap 'rm -rf "${TMP}"' EXIT
+
+fail() {
+  echo "error: $@" >&2
+  exit 1
+}
+
+size_bytes() {
+  case "$(uname -s)" in
+    Darwin) stat -f%z "${1}" ;;
+    Linux) stat -c%s "${1}" ;;
+    *) fail "must be run on darwin or linux" ;;
+  esac
+}
+
+# Build in the same manner as we do in release.bash.
+CGO_ENABLED=0 \
+  GOOS=darwin \
+  GOARCH=arm64 \
+  go build -a -ldflags "-s -w" -trimpath -buildvcs=false \
+  -o "${TMP}/bin" \
+  "${1}"
+
+echo "$(awk "BEGIN { printf(\"%.2f\", $(size_bytes "${TMP}/bin") / 1048576.0) }") MB"
diff --git a/private/bufpkg/bufplugin/bufplugindocker/testdata/success/Dockerfile b/private/bufpkg/bufplugin/bufplugindocker/testdata/success/Dockerfile
index a4b4ea99a8..7be5bacafb 100644
--- a/private/bufpkg/bufplugin/bufplugindocker/testdata/success/Dockerfile
+++ b/private/bufpkg/bufplugin/bufplugindocker/testdata/success/Dockerfile
@@ -1,3 +1,3 @@
-FROM alpine:3.19.0
+FROM alpine:3.19.1
 
 RUN echo "success"