diff --git a/Dockerfile b/Dockerfile
index bf18b1a..0c03b56 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,10 +6,10 @@ SHELL ["/bin/ash", "-o", "pipefail", "-c"]
 
 RUN apk update && \
     apk add --no-cache \
-      curl==8.8.0-r0 \
+      curl==8.9.0-r0 \
       bash==5.2.26-r0 \
-      ca-certificates==20240226-r0 \
-      openssl==3.3.1-r1 && \
+      ca-certificates==20240705-r0 \
+      openssl==3.3.1-r3 && \
     openssl s_client -connect helloworld.letsencrypt.org:443 -showcerts </dev/null 2>/dev/null | sed -e '/-----BEGIN/,/-----END/!d' | tee "/usr/local/share/ca-certificates/letsencrypt.crt" >/dev/null && \
     update-ca-certificates
 
diff --git a/ci/update-docker.sh b/ci/update-docker.sh
new file mode 100755
index 0000000..dac091f
--- /dev/null
+++ b/ci/update-docker.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+set -eou pipefail
+
+get_latest_version() {
+    PACKAGE_NAME=$1
+    # TODO: is there really no JSON API for this?
+    PACKAGE_REPO_URL="https://pkgs.alpinelinux.org/package/v3.20/main/x86_64/$PACKAGE_NAME"
+    PACKAGE_INFO=$(curl -s "$PACKAGE_REPO_URL")
+    if echo "$PACKAGE_INFO" | grep -q "404 Page not found"; then
+        PACKAGE_INFO=$(curl -s "https://pkgs.alpinelinux.org/package/v3.20/community/x86_64/$PACKAGE_NAME")
+    fi
+    LATEST_VERSION=$(echo "$PACKAGE_INFO" | grep -A 2 '<th class="header">Version</th>' | tail -n 1 | xargs)
+
+    echo "$LATEST_VERSION"
+}
+
+find . -name 'Dockerfile' | while read -r DOCKERFILE; do
+    echo "Checking $DOCKERFILE"
+    grep -s '==' "$DOCKERFILE" > /dev/null || continue
+    ggrep -soP '[a-zA-Z0-9_\-]+==[a-zA-Z0-9_\-\.]+' "$DOCKERFILE" | tr -d '\\' | while read -r PACKAGE; do
+        echo -e "\tChecking $PACKAGE"
+        PACKAGE_NAME=$(echo "$PACKAGE" | cut -d'=' -f1|awk '{print $1}')
+        CURRENT_VERSION=$(echo "$PACKAGE" | cut -d'=' -f3|awk '{print $1}')
+        LATEST_VERSION=$(get_latest_version "$PACKAGE_NAME")
+        if [ "$LATEST_VERSION" = "" ]; then
+          continue
+        fi
+        if [[ "$LATEST_VERSION" != "$CURRENT_VERSION" ]]; then
+            echo -e "\t\tUpdating to $LATEST_VERSION"
+            sed -E "s/($PACKAGE_NAME)==$CURRENT_VERSION/\1==$LATEST_VERSION/" "$DOCKERFILE" > "${DOCKERFILE}.bak"
+            mv "${DOCKERFILE}.bak" "$DOCKERFILE"
+        else
+            echo -e "\t\t$PACKAGE_NAME is already up to date."
+        fi
+    done
+done
diff --git a/examples/coverpage/Dockerfile b/examples/coverpage/Dockerfile
index 80428ce..976a6d9 100644
--- a/examples/coverpage/Dockerfile
+++ b/examples/coverpage/Dockerfile
@@ -5,8 +5,6 @@ FROM pandoc/latex:3.2.0 AS pandoc
 
 RUN apk update && \
     apk add --no-cache \
-      bash==5.2.21-r0 \
-      curl==8.5.0-r0 \
       ghostscript==10.03.1-r0 \
       jq==1.7.1-r0
 
diff --git a/examples/libreoffice/Dockerfile b/examples/libreoffice/Dockerfile
index 9cc8a59..ae26019 100644
--- a/examples/libreoffice/Dockerfile
+++ b/examples/libreoffice/Dockerfile
@@ -7,6 +7,6 @@ COPY cmd.sh /app/
 
 RUN apk update && \
   apk add --no-cache \
-    openjdk17-jre==17.0.11_p9-r0 \
+    openjdk17-jre==17.0.12_p7-r0 \
     libreoffice==7.6.7.2-r0 \
     ttf-dejavu==2.37-r5
diff --git a/examples/tesseract/Dockerfile b/examples/tesseract/Dockerfile
index 392a0c1..434dde1 100644
--- a/examples/tesseract/Dockerfile
+++ b/examples/tesseract/Dockerfile
@@ -2,21 +2,19 @@ ARG TAG=main
 ARG DOCKER_REPOSITORY=local
 FROM ${DOCKER_REPOSITORY}/scyllaridae:${TAG}
 
-ARG TESSERACT_VERSION=5.3.4-r0
-
 RUN apk update && \
     apk add --no-cache \
         leptonica-dev==1.84.1-r0 \
-        tesseract-ocr==${TESSERACT_VERSION} \
-        tesseract-ocr-data-eng==${TESSERACT_VERSION} \
-        tesseract-ocr-data-fra==${TESSERACT_VERSION} \
-        tesseract-ocr-data-spa==${TESSERACT_VERSION} \
-        tesseract-ocr-data-ita==${TESSERACT_VERSION} \
-        tesseract-ocr-data-por==${TESSERACT_VERSION} \
-        tesseract-ocr-data-hin==${TESSERACT_VERSION} \
-        tesseract-ocr-data-deu==${TESSERACT_VERSION} \
-        tesseract-ocr-data-jpn==${TESSERACT_VERSION} \
-        tesseract-ocr-data-rus==${TESSERACT_VERSION} \
+        tesseract-ocr==5.3.4-r0 \
+        tesseract-ocr-data-eng==5.3.4-r0 \
+        tesseract-ocr-data-fra==5.3.4-r0 \
+        tesseract-ocr-data-spa==5.3.4-r0 \
+        tesseract-ocr-data-ita==5.3.4-r0 \
+        tesseract-ocr-data-por==5.3.4-r0 \
+        tesseract-ocr-data-hin==5.3.4-r0 \
+        tesseract-ocr-data-deu==5.3.4-r0 \
+        tesseract-ocr-data-jpn==5.3.4-r0 \
+        tesseract-ocr-data-rus==5.3.4-r0 \
         poppler-utils==24.02.0-r1
 
 COPY scyllaridae.yml /app/scyllaridae.yml