diff --git a/Dockerfile b/Dockerfile
index e7f6d1a..fc3aaf2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM ghcr.io/linuxserver/baseimage-alpine:3.17
+FROM ghcr.io/linuxserver/baseimage-alpine:3.18
 
 # set version label
 ARG BUILD_DATE
@@ -11,7 +11,7 @@ LABEL maintainer="aptalca"
 
 RUN \
   echo "**** install build packages ****" && \
-  apk add --no-cache --virtual=build-dependencies --upgrade \
+  apk add --no-cache --virtual=build-dependencies \
     build-base \
     cairo-dev \
     cargo \
@@ -26,7 +26,7 @@ RUN \
     openjpeg-dev \
     python3-dev && \
   echo "**** install runtime packages ****" && \
-  apk add --no-cache --upgrade \
+  apk add --no-cache \
     chromaprint \
     expat \
     ffmpeg \
@@ -70,11 +70,11 @@ RUN \
   if [ -z ${BEETS_VERSION+x} ]; then \
     BEETS_VERSION=$(curl -sL  https://pypi.python.org/pypi/beets/json |jq -r '. | .info.version'); \
   fi && \
-  python3 -m ensurepip && \
-  pip3 install -U --no-cache-dir \
+  python3 -m venv /lsiopy && \
+  pip install -U --no-cache-dir \
     pip \
     wheel && \
-  pip3 install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.17/ \
+  pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.18/ \
     beautifulsoup4 \
     beets==${BEETS_VERSION} \
     beets-extrafiles \
@@ -82,7 +82,7 @@ RUN \
     discogs-client \
     flask \
     PyGObject \
-    pillow \
+    Pillow==9.5.0 \
     pyacoustid \
     pylast \
     requests \
diff --git a/Dockerfile.aarch64 b/Dockerfile.aarch64
index 4d7857b..57bc35d 100644
--- a/Dockerfile.aarch64
+++ b/Dockerfile.aarch64
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.17
+FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.18
 
 # set version label
 ARG BUILD_DATE
@@ -11,7 +11,7 @@ LABEL maintainer="aptalca"
 
 RUN \
   echo "**** install build packages ****" && \
-  apk add --no-cache --virtual=build-dependencies --upgrade \
+  apk add --no-cache --virtual=build-dependencies \
     build-base \
     cairo-dev \
     cargo \
@@ -26,7 +26,7 @@ RUN \
     openjpeg-dev \
     python3-dev && \
   echo "**** install runtime packages ****" && \
-  apk add --no-cache --upgrade \
+  apk add --no-cache \
     chromaprint \
     expat \
     ffmpeg \
@@ -71,11 +71,11 @@ RUN \
   if [ -z ${BEETS_VERSION+x} ]; then \
     BEETS_VERSION=$(curl -sL  https://pypi.python.org/pypi/beets/json |jq -r '. | .info.version'); \
   fi && \
-  python3 -m ensurepip && \
-  pip3 install -U --no-cache-dir \
+  python3 -m venv /lsiopy && \
+  pip install -U --no-cache-dir \
     pip \
     wheel && \
-  pip3 install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.17/ \
+  pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.18/ \
     beautifulsoup4 \
     beets==${BEETS_VERSION} \
     beets-extrafiles \
@@ -83,7 +83,7 @@ RUN \
     discogs-client \
     flask \
     PyGObject \
-    pillow \
+    Pillow==9.5.0 \
     pyacoustid \
     pylast \
     requests \
diff --git a/README.md b/README.md
index fdf4221..fa72604 100644
--- a/README.md
+++ b/README.md
@@ -244,6 +244,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **25.08.23:** - Rebase to Alpine 3.18, pin Pillow to 9.5.0.
 * **07.07.23:** - Deprecate armhf. As announced [here](https://www.linuxserver.io/blog/a-farewell-to-arm-hf)
 * **25.03.23:** - Add requests_oauthlib required for [beatport plugin](https://beets.readthedocs.io/en/stable/plugins/beatport.html).
 * **24.02.23:** - Rebase to Alpine 3.17, migrate to s6v3, install chromaprint from Alpine repos, add beetcamp plugin.
diff --git a/jenkins-vars.yml b/jenkins-vars.yml
index 0e9b85d..1cf3fcb 100644
--- a/jenkins-vars.yml
+++ b/jenkins-vars.yml
@@ -6,6 +6,7 @@ external_type: pip_version
 release_type: stable
 release_tag: latest
 ls_branch: master
+build_armhf: false
 repo_vars:
   - BUILD_VERSION_ARG = 'BEETS_VERSION'
   - EXT_PIP='beets'
diff --git a/readme-vars.yml b/readme-vars.yml
index 9d21812..dad527a 100644
--- a/readme-vars.yml
+++ b/readme-vars.yml
@@ -45,6 +45,7 @@ app_setup_block: |
   Contains [beets-extrafiles](https://github.com/Holzhaus/beets-extrafiles) plugin, [configuration details](https://github.com/Holzhaus/beets-extrafiles#usage)
 # changelog
 changelogs:
+  - {date: "25.08.23:", desc: "Rebase to Alpine 3.18, pin Pillow to 9.5.0."}
   - {date: "07.07.23:", desc: "Deprecate armhf. As announced [here](https://www.linuxserver.io/blog/a-farewell-to-arm-hf)"}
   - {date: "25.03.23:", desc: "Add requests_oauthlib required for [beatport plugin](https://beets.readthedocs.io/en/stable/plugins/beatport.html)."}
   - {date: "24.02.23:", desc: "Rebase to Alpine 3.17, migrate to s6v3, install chromaprint from Alpine repos, add beetcamp plugin."}