diff --git a/notwa-util/Dockerfile b/notwa-util/Dockerfile
index 5fe249e..740a387 100644
--- a/notwa-util/Dockerfile
+++ b/notwa-util/Dockerfile
@@ -10,8 +10,8 @@ WORKDIR /media/common
 
 FROM partial as downloader
 # this demonstrates how to use the `acquire` script.
-ARG BUSYBOX_VERSION=1.35.0
-ARG BUSYBOX_SHA256=faeeb244c35a348a334f4a59e44626ee870fb07b6884d68c10ae8bc19f83a694
+ARG BUSYBOX_VERSION=1.36.0
+ARG BUSYBOX_SHA256=542750c8af7cb2630e201780b4f99f3dcceeb06f505b479ec68241c1e6af61a5
 RUN --mount=type=cache,id=common,target=/media/common,sharing=locked \
     --mount=type=tmpfs,target=/tmp : \
  && name=busybox \
@@ -30,7 +30,6 @@ RUN apk add --no-cache gcc linux-headers make musl-dev
 # this can greatly differ from Alpine's build of busybox.
 # for one thing, this build is half the size of Alpine's.
 # this binary is *not* an APE; it's only for Linux hosts.
-# TODO: inherit security patches from Alpine.
 COPY --from=downloader /root /root
 WORKDIR /root/busybox
 COPY busybox.config .config
diff --git a/notwa-util/busybox.config b/notwa-util/busybox.config
index 7f240f2..a961878 100644
--- a/notwa-util/busybox.config
+++ b/notwa-util/busybox.config
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Busybox version: 1.35.0
-# Fri Aug 26 10:43:25 2022
+# Busybox version: 1.36.0
+# Fri Apr 28 16:02:12 2023
 #
 CONFIG_HAVE_DOT_CONFIG=y
 
@@ -93,6 +93,9 @@ CONFIG_FEATURE_BUFFERS_USE_MALLOC=y
 # CONFIG_FEATURE_BUFFERS_GO_IN_BSS is not set
 CONFIG_PASSWORD_MINLEN=6
 CONFIG_MD5_SMALL=2
+CONFIG_SHA1_SMALL=3
+# CONFIG_SHA1_HWACCEL is not set
+# CONFIG_SHA256_HWACCEL is not set
 CONFIG_SHA3_SMALL=1
 CONFIG_FEATURE_NON_POSIX_CP=y
 # CONFIG_FEATURE_VERBOSE_CP_MESSAGE is not set
@@ -123,6 +126,9 @@ CONFIG_LAST_SUPPORTED_WCHAR=0
 # CONFIG_UNICODE_BIDI_SUPPORT is not set
 # CONFIG_UNICODE_NEUTRAL_TABLE is not set
 # CONFIG_UNICODE_PRESERVE_BROKEN is not set
+# CONFIG_LOOP_CONFIGURE is not set
+# CONFIG_NO_LOOP_CONFIGURE is not set
+CONFIG_TRY_LOOP_CONFIGURE=y
 
 #
 # Applets
@@ -338,6 +344,7 @@ CONFIG_FEATURE_TEST_64=y
 # CONFIG_FEATURE_TR_EQUIV is not set
 CONFIG_TRUE=y
 CONFIG_TRUNCATE=y
+# CONFIG_TSORT is not set
 # CONFIG_TTY is not set
 # CONFIG_UNAME is not set
 CONFIG_UNAME_OSNAME=""
@@ -823,10 +830,12 @@ CONFIG_READAHEAD=y
 # CONFIG_RFKILL is not set
 # CONFIG_RUNLEVEL is not set
 # CONFIG_RX is not set
+# CONFIG_SEEDRNG is not set
 CONFIG_SETFATTR=y
 # CONFIG_SETSERIAL is not set
 # CONFIG_STRINGS is not set
 CONFIG_TIME=y
+# CONFIG_TREE is not set
 # CONFIG_TS is not set
 CONFIG_TTYSIZE=y
 # CONFIG_UBIATTACH is not set
@@ -999,6 +1008,7 @@ CONFIG_DHCPD_LEASES_FILE=""
 # CONFIG_FEATURE_UDHCPC_ARPING is not set
 # CONFIG_FEATURE_UDHCPC_SANITIZEOPT is not set
 CONFIG_UDHCPC_DEFAULT_SCRIPT=""
+CONFIG_UDHCPC6_DEFAULT_SCRIPT=""
 # CONFIG_UDHCPC6 is not set
 # CONFIG_FEATURE_UDHCPC6_RFC3646 is not set
 # CONFIG_FEATURE_UDHCPC6_RFC4704 is not set
@@ -1129,6 +1139,7 @@ CONFIG_ASH_EXPAND_PRMT=y
 CONFIG_ASH_ECHO=y
 CONFIG_ASH_PRINTF=y
 CONFIG_ASH_TEST=y
+CONFIG_ASH_SLEEP=y
 # CONFIG_ASH_HELP is not set
 CONFIG_ASH_GETOPTS=y
 CONFIG_ASH_CMDCMD=y