diff --git a/.circleci/config.yml b/.circleci/config.yml
index 884144dd7..effa7c1af 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -136,7 +136,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:v2.15.0 || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
       #;> TOOL_HADOLINT
 
diff --git a/.claude/skills/prepare-vortex-release/SKILL.md b/.claude/skills/prepare-vortex-release/SKILL.md
index aa2a967ed..c91ff74da 100644
--- a/.claude/skills/prepare-vortex-release/SKILL.md
+++ b/.claude/skills/prepare-vortex-release/SKILL.md
@@ -62,6 +62,17 @@ Work through each checklist item from the release process doc:
 
 1. **Dependencies** - Skip Renovate (user must run manually). Note as unchecked.
 2. **Container images** - Check current versions in CI configs, verify if latest.
+   - **CI tool images** - `hadolint`, `dclint`, `gitleaks` and `actionlint` are
+     invoked as `docker run <image>:<tag>` inside `.github/workflows/**` and
+     `.circleci/config.yml`. The `customManagers` regex in `renovate.json`
+     tracks them, so this is a verification step, not a manual bump: confirm
+     no open Renovate PR is bumping them and that both CI providers carry the
+     same tag for the same tool. Bump by hand only when Renovate has not
+     picked a release up, and in that case pin the identical tag in
+     `.vortex/tests/lint.dockerfiles.sh` so a local run matches CI.
+   - An untagged image reference is a release blocker regardless of Renovate:
+     it resolves to `latest` and lets an upstream release break a default
+     branch on a commit that changed nothing.
 3. **PHP version** - Run `docker compose run --rm cli php -r "echo PHP_VERSION;"` and
    `docker compose run --rm cli php -r "echo PHP_VERSION_ID;"` to get the container
    PHP version. Update `composer.json` (`config.platform.php`), `phpstan.neon`
diff --git a/.docker/clamav.dockerfile b/.docker/clamav.dockerfile
index e80ced3c7..6479c1081 100644
--- a/.docker/clamav.dockerfile
+++ b/.docker/clamav.dockerfile
@@ -5,8 +5,6 @@
 # Allow running ClamAV in rootless mode.
 # @see https://github.com/Cisco-Talos/clamav/issues/478
 #
-# hadolint global ignore=DL3008,DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/commons/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/commons
 
@@ -17,6 +15,7 @@ FROM clamav/clamav-debian:1.5.3
 COPY --from=commons /lagoon /lagoon
 COPY --from=commons /bin/fix-permissions /bin/ep /bin/docker-sleep /bin/wait-for /bin/
 
+# hadolint ignore=DL3008 # the package set tracks the pinned base image
 RUN apt-get update -qq && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata && \
     apt-get clean && rm -rf /var/lib/apt/lists/*
@@ -30,10 +29,12 @@ RUN cat /tmp/clamav.conf >> /etc/clamav/clamd.conf && \
     sed -i "s/^UpdateLogFile /# UpdateLogFile /g" /etc/clamav/freshclam.conf && \
     sed -i "s/^#LogSyslog /LogSyslog /g" /etc/clamav/freshclam.conf
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER root
 
 RUN fix-permissions /var/lib/clamav
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER clamav
 
 ENTRYPOINT [ "/init-unprivileged" ]
diff --git a/.docker/cli.dockerfile b/.docker/cli.dockerfile
index bada8f918..134a4b860 100644
--- a/.docker/cli.dockerfile
+++ b/.docker/cli.dockerfile
@@ -3,11 +3,7 @@
 #
 # All CLI operations performed in this container.
 #
-# The `PACKAGE_TOKEN` argument below is flagged by name by the
-# `SecretsUsedInArgOrEnv` build check, but the token is passed as a build
-# secret and never written to an image layer, so that check is skipped.
-#
-# hadolint global ignore=DL3018,SC2174
+# The check skipped above is BuildKit's twin of DL3064, ignored inline below.
 #
 # @see https://hub.docker.com/r/uselagoon/php-8.4-cli-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/php-cli-drupal
@@ -26,12 +22,15 @@ ENV WEBROOT=${WEBROOT}
 
 # Token is used to access private repositories. Not exposed as an environment
 # variable within an image to avoid baking it into the image.
+# hadolint ignore=DL3064 # empty here, the value comes from a build secret
 ARG PACKAGE_TOKEN=""
 
 ARG DRUPAL_PUBLIC_FILES="sites/default/files"
 ENV DRUPAL_PUBLIC_FILES=${DRUPAL_PUBLIC_FILES}
 
+# hadolint ignore=DL3064 # a path, not a secret
 ARG DRUPAL_PRIVATE_FILES="sites/default/files/private"
+# hadolint ignore=DL3064 # a path, not a secret
 ENV DRUPAL_PRIVATE_FILES=${DRUPAL_PRIVATE_FILES}
 
 ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
@@ -61,6 +60,7 @@ ENV PHP_INI_SCAN_DIR="${PHP_INI_SCAN_DIR}:/app/drush/php-ini"
 # earlier in the build process (near the top of this file).
 
 # Add more tools.
+# hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache ncurses pv tzdata autoconf g++ make && \
     pecl install pcov && \
     docker-php-ext-enable pcov && \
@@ -89,7 +89,6 @@ COPY .vortex/tooling /app/.vortex/tooling
 
 # Install PHP dependencies without development packages to avoid exposing
 # potential security vulnerabilities in the production environment.
-# hadolint ignore=SC2155
 RUN --mount=type=secret,id=package_token \
     token=$(if [ -s /run/secrets/package_token ]; then cat /run/secrets/package_token; else echo "${PACKAGE_TOKEN}"; fi) && \
     if [ -n "${token}" ]; then export COMPOSER_AUTH="{\"github-oauth\": {\"github.com\": \"${token}\"}}"; fi && \
@@ -100,6 +99,7 @@ RUN --mount=type=secret,id=package_token \
 COPY . /app
 
 # Create file directories and set correct permissions.
+# hadolint ignore=SC2174 # only the leaf directory needs the mode
 RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
 
 #;< DRUPAL_THEME
diff --git a/.docker/database.dockerfile b/.docker/database.dockerfile
index 1a0929ff7..a59f3a6da 100644
--- a/.docker/database.dockerfile
+++ b/.docker/database.dockerfile
@@ -6,15 +6,17 @@
 # The ARG value will be updated with a value passed from docker-compose.yml
 
 ARG IMAGE=uselagoon/mysql-8.4:26.8.0
-# hadolint ignore=DL3006
 FROM ${IMAGE}
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER root
 COPY ./.docker/config/database/my.cnf /etc/my.cnf.d/server.cnf
 RUN fix-permissions /etc/my.cnf.d/
 
+# hadolint ignore=DL3064 # local development credentials only
 ENV MYSQL_DATABASE=drupal \
     MYSQL_USER=drupal \
     MYSQL_PASSWORD=drupal
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER mysql
diff --git a/.docker/nginx-drupal.dockerfile b/.docker/nginx-drupal.dockerfile
index 5c5fce0ed..c0f531fcc 100644
--- a/.docker/nginx-drupal.dockerfile
+++ b/.docker/nginx-drupal.dockerfile
@@ -2,13 +2,10 @@
 #
 # All web requests are sent to this container.
 #
-# hadolint global ignore=DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/nginx-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/nginx-drupal
 
 ARG CLI_IMAGE
-# hadolint ignore=DL3006
 FROM ${CLI_IMAGE:-cli} AS cli
 
 FROM uselagoon/nginx-drupal:26.7.0
@@ -17,6 +14,7 @@ FROM uselagoon/nginx-drupal:26.7.0
 ARG WEBROOT=web
 ENV WEBROOT=${WEBROOT}
 
+# hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache tzdata
 
 COPY ./.docker/config/nginx/redirects-map.conf /etc/nginx/redirects-map.conf
diff --git a/.docker/php.dockerfile b/.docker/php.dockerfile
index d95489543..114a34726 100644
--- a/.docker/php.dockerfile
+++ b/.docker/php.dockerfile
@@ -3,17 +3,15 @@
 # All web requests are sent from Nginx to this container.
 # This container would be scaled up/down in production.
 #
-# hadolint global ignore=DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/php-8.4-fpm/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/php-fpm
 
 ARG CLI_IMAGE
-# hadolint ignore=DL3006
 FROM ${CLI_IMAGE:-cli} AS cli
 
 FROM uselagoon/php-8.4-fpm:26.7.0
 
+# hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache tzdata
 
 COPY --from=cli /app /app
diff --git a/.docker/solr.dockerfile b/.docker/solr.dockerfile
index 6bc87c6a5..26051ef14 100644
--- a/.docker/solr.dockerfile
+++ b/.docker/solr.dockerfile
@@ -1,7 +1,5 @@
 # Solr container.
 #
-# hadolint global ignore=DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/solr-9-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/blob/main/images/solr-drupal/9.Dockerfile
 
@@ -16,6 +14,7 @@ FROM uselagoon/solr-9-drupal:26.8.0
 # whenever this image tag is bumped.
 COPY .docker/config/solr/config-set /solr-conf/conf/
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER root
 
 # Apply custom modifications for Lagoon environment compatibility.
@@ -23,6 +22,7 @@ RUN sed -i -e "s#<dataDir>\${solr.data.dir:}#<dataDir>/var/solr/\${solr.core.nam
     sed -i -e "s#solr.lock.type:native#solr.lock.type:none#g" /solr-conf/conf/solrconfig.xml && \
     sed -i -e "s#solr.autoSoftCommit.MaxTime=5000#solr.autoSoftCommit.MaxTime=-1#g" /solr-conf/conf/solrcore.properties
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER solr
 
 # solr-precreate is provided by the base Solr container image.
diff --git a/.github/workflows/build-test-deploy.yml b/.github/workflows/build-test-deploy.yml
index 1dea3c571..6b2513e57 100644
--- a/.github/workflows/build-test-deploy.yml
+++ b/.github/workflows/build-test-deploy.yml
@@ -130,7 +130,7 @@ jobs:
       - name: Lint Dockerfiles with Hadolint
         run: |
           find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \) | while read -r file; do
-            echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint
+            echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:v2.15.0
           done
         continue-on-error: ${{ vars.VORTEX_CI_HADOLINT_IGNORE_FAILURE == '1' }}
       #;> TOOL_HADOLINT
diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/clamav.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/clamav.dockerfile
index 0e2627622..eaabdac03 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/clamav.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/clamav.dockerfile
@@ -5,8 +5,6 @@
 # Allow running ClamAV in rootless mode.
 # @see https://github.com/Cisco-Talos/clamav/issues/478
 #
-# hadolint global ignore=DL3008,DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/commons/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/commons
 
@@ -17,6 +15,7 @@ FROM clamav/clamav-debian:__VERSION__
 COPY --from=commons /lagoon /lagoon
 COPY --from=commons /bin/fix-permissions /bin/ep /bin/docker-sleep /bin/wait-for /bin/
 
+# hadolint ignore=DL3008 # the package set tracks the pinned base image
 RUN apt-get update -qq && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata && \
     apt-get clean && rm -rf /var/lib/apt/lists/*
@@ -30,10 +29,12 @@ RUN cat /tmp/clamav.conf >> /etc/clamav/clamd.conf && \
     sed -i "s/^UpdateLogFile /# UpdateLogFile /g" /etc/clamav/freshclam.conf && \
     sed -i "s/^#LogSyslog /LogSyslog /g" /etc/clamav/freshclam.conf
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER root
 
 RUN fix-permissions /var/lib/clamav
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER clamav
 
 ENTRYPOINT [ "/init-unprivileged" ]
diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/cli.dockerfile
index 7181ff576..94495b2b4 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/cli.dockerfile
@@ -3,11 +3,7 @@
 #
 # All CLI operations performed in this container.
 #
-# The `PACKAGE_TOKEN` argument below is flagged by name by the
-# `SecretsUsedInArgOrEnv` build check, but the token is passed as a build
-# secret and never written to an image layer, so that check is skipped.
-#
-# hadolint global ignore=DL3018,SC2174
+# The check skipped above is BuildKit's twin of DL3064, ignored inline below.
 #
 # @see https://hub.docker.com/r/uselagoon/php-8.4-cli-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/php-cli-drupal
@@ -26,12 +22,15 @@ ENV WEBROOT=${WEBROOT}
 
 # Token is used to access private repositories. Not exposed as an environment
 # variable within an image to avoid baking it into the image.
+# hadolint ignore=DL3064 # empty here, the value comes from a build secret
 ARG PACKAGE_TOKEN=""
 
 ARG DRUPAL_PUBLIC_FILES="sites/default/files"
 ENV DRUPAL_PUBLIC_FILES=${DRUPAL_PUBLIC_FILES}
 
+# hadolint ignore=DL3064 # a path, not a secret
 ARG DRUPAL_PRIVATE_FILES="sites/default/files/private"
+# hadolint ignore=DL3064 # a path, not a secret
 ENV DRUPAL_PRIVATE_FILES=${DRUPAL_PRIVATE_FILES}
 
 ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
@@ -61,6 +60,7 @@ ENV PHP_INI_SCAN_DIR="${PHP_INI_SCAN_DIR}:/app/drush/php-ini"
 # earlier in the build process (near the top of this file).
 
 # Add more tools.
+# hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache ncurses pv tzdata autoconf g++ make && \
     pecl install pcov && \
     docker-php-ext-enable pcov && \
@@ -82,7 +82,6 @@ COPY composer.json composer.* patches.lock.* .env* auth* /app/
 
 # Install PHP dependencies without development packages to avoid exposing
 # potential security vulnerabilities in the production environment.
-# hadolint ignore=SC2155
 RUN --mount=type=secret,id=package_token \
     token=$(if [ -s /run/secrets/package_token ]; then cat /run/secrets/package_token; else echo "${PACKAGE_TOKEN}"; fi) && \
     if [ -n "${token}" ]; then export COMPOSER_AUTH="{\"github-oauth\": {\"github.com\": \"${token}\"}}"; fi && \
@@ -93,6 +92,7 @@ RUN --mount=type=secret,id=package_token \
 COPY . /app
 
 # Create file directories and set correct permissions.
+# hadolint ignore=SC2174 # only the leaf directory needs the mode
 RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
 
 RUN if [ "${VORTEX_FRONTEND_BUILD_SKIP}" != "1" ]; then \
diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/database.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/database.dockerfile
index b21f8f9be..74b4be063 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/database.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/database.dockerfile
@@ -6,15 +6,17 @@
 # The ARG value will be updated with a value passed from docker-compose.yml
 
 ARG IMAGE=uselagoon/mysql-8.4:__VERSION__
-# hadolint ignore=DL3006
 FROM ${IMAGE}
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER root
 COPY ./.docker/config/database/my.cnf /etc/my.cnf.d/server.cnf
 RUN fix-permissions /etc/my.cnf.d/
 
+# hadolint ignore=DL3064 # local development credentials only
 ENV MYSQL_DATABASE=drupal \
     MYSQL_USER=drupal \
     MYSQL_PASSWORD=drupal
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER mysql
diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/nginx-drupal.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/nginx-drupal.dockerfile
index 233199327..f9baeb0d2 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/nginx-drupal.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/nginx-drupal.dockerfile
@@ -2,13 +2,10 @@
 #
 # All web requests are sent to this container.
 #
-# hadolint global ignore=DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/nginx-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/nginx-drupal
 
 ARG CLI_IMAGE
-# hadolint ignore=DL3006
 FROM ${CLI_IMAGE:-cli} AS cli
 
 FROM uselagoon/nginx-drupal:__VERSION__
@@ -17,6 +14,7 @@ FROM uselagoon/nginx-drupal:__VERSION__
 ARG WEBROOT=web
 ENV WEBROOT=${WEBROOT}
 
+# hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache tzdata
 
 COPY ./.docker/config/nginx/redirects-map.conf /etc/nginx/redirects-map.conf
diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/php.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/php.dockerfile
index ac2e827db..5808dafd4 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/php.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/php.dockerfile
@@ -3,17 +3,15 @@
 # All web requests are sent from Nginx to this container.
 # This container would be scaled up/down in production.
 #
-# hadolint global ignore=DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/php-8.4-fpm/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/php-fpm
 
 ARG CLI_IMAGE
-# hadolint ignore=DL3006
 FROM ${CLI_IMAGE:-cli} AS cli
 
 FROM uselagoon/php-8.4-fpm:__VERSION__
 
+# hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache tzdata
 
 COPY --from=cli /app /app
diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/solr.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/solr.dockerfile
index cadf8d4c2..0ebae6b90 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/solr.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/solr.dockerfile
@@ -1,7 +1,5 @@
 # Solr container.
 #
-# hadolint global ignore=DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/solr-9-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/blob/main/images/solr-drupal/9.Dockerfile
 
@@ -16,6 +14,7 @@ FROM uselagoon/solr-9-drupal:__VERSION__
 # whenever this image tag is bumped.
 COPY .docker/config/solr/config-set /solr-conf/conf/
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER root
 
 # Apply custom modifications for Lagoon environment compatibility.
@@ -23,6 +22,7 @@ RUN sed -i -e "s#<dataDir>\${solr.data.dir:}#<dataDir>/var/solr/\${solr.core.nam
     sed -i -e "s#solr.lock.type:native#solr.lock.type:none#g" /solr-conf/conf/solrconfig.xml && \
     sed -i -e "s#solr.autoSoftCommit.MaxTime=5000#solr.autoSoftCommit.MaxTime=-1#g" /solr-conf/conf/solrcore.properties
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER solr
 
 # solr-precreate is provided by the base Solr container image.
diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml
index af43eafa1..f5454f03d 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml
@@ -116,7 +116,7 @@ jobs:
       - name: Lint Dockerfiles with Hadolint
         run: |
           find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \) | while read -r file; do
-            echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint
+            echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__
           done
         continue-on-error: ${{ vars.VORTEX_CI_HADOLINT_IGNORE_FAILURE == '1' }}
 
diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/renovate.json b/.vortex/installer/tests/Fixtures/handler_process/_baseline/renovate.json
index b1a7b1b34..b68037407 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/renovate.json
+++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/renovate.json
@@ -170,7 +170,9 @@
             "groupName": "Container images - All - Major, minor and patch",
             "groupSlug": "container-images-all-major-minor-patch",
             "matchFileNames": [
-                ".docker/**"
+                ".docker/**",
+                ".circleci/**",
+                ".github/workflows/**"
             ],
             "schedule": [
                 "before 3am"
@@ -205,6 +207,18 @@
             ],
             "datasourceTemplate": "docker",
             "versioningTemplate": "docker"
+        },
+        {
+            "customType": "regex",
+            "managerFilePatterns": [
+                "/^\\.circleci/config\\.yml$/",
+                "/^\\.github/workflows/.+\\.yml$/"
+            ],
+            "matchStrings": [
+                "docker run[^\\n]*?\\s(?<depName>[a-z0-9][a-z0-9._\\-]*(?:/[a-z0-9._\\-]+)+):(?<currentValue>v?[0-9][\\w.\\-]*)"
+            ],
+            "datasourceTemplate": "docker",
+            "versioningTemplate": "docker"
         }
     ]
 }
diff --git a/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.circleci/config.yml
index 9cd8e6c1b..7fff3cf77 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.circleci/config.yml
index 9847c75fb..8d3c7eb2f 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.circleci/config.yml
index 9cd8e6c1b..7fff3cf77 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.circleci/config.yml
index d0db3e830..f436e4c9c 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.circleci/config.yml
index 9cd8e6c1b..7fff3cf77 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.docker/cli.dockerfile
index a39f0f434..7d1d14733 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -21,7 +21,7 @@
+@@ -17,7 +17,7 @@
  ARG LAGOON_PR_HEAD_SHA=""
  ENV LAGOON_PR_HEAD_SHA=${LAGOON_PR_HEAD_SHA}
  
diff --git a/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.docker/nginx-drupal.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.docker/nginx-drupal.dockerfile
index 7d6c276fd..5bba52b44 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.docker/nginx-drupal.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.docker/nginx-drupal.dockerfile
@@ -1,4 +1,4 @@
-@@ -14,7 +14,7 @@
+@@ -11,7 +11,7 @@
  FROM uselagoon/nginx-drupal:__VERSION__
  
  # Webroot is used for Nginx web root configuration.
@@ -6,4 +6,4 @@
 +ARG WEBROOT=docroot
  ENV WEBROOT=${WEBROOT}
  
- RUN apk add --no-cache tzdata
+ # hadolint ignore=DL3018 # the package set tracks the pinned base image
diff --git a/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.docker/cli.dockerfile
index a39f0f434..7d1d14733 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -21,7 +21,7 @@
+@@ -17,7 +17,7 @@
  ARG LAGOON_PR_HEAD_SHA=""
  ENV LAGOON_PR_HEAD_SHA=${LAGOON_PR_HEAD_SHA}
  
diff --git a/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.docker/nginx-drupal.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.docker/nginx-drupal.dockerfile
index 7d6c276fd..5bba52b44 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.docker/nginx-drupal.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.docker/nginx-drupal.dockerfile
@@ -1,4 +1,4 @@
-@@ -14,7 +14,7 @@
+@@ -11,7 +11,7 @@
  FROM uselagoon/nginx-drupal:__VERSION__
  
  # Webroot is used for Nginx web root configuration.
@@ -6,4 +6,4 @@
 +ARG WEBROOT=docroot
  ENV WEBROOT=${WEBROOT}
  
- RUN apk add --no-cache tzdata
+ # hadolint ignore=DL3018 # the package set tracks the pinned base image
diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.circleci/config.yml
index 9cd8e6c1b..7fff3cf77 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.circleci/config.yml
index 57386feb3..e1446bb5e 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/names/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/names/.docker/cli.dockerfile
index 20c5a59d5..e94e3fe1c 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/names/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/names/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -37,7 +37,7 @@
+@@ -36,7 +36,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.docker/cli.dockerfile
index c6e5e90e0..4abfebbec 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -37,7 +37,7 @@
+@@ -36,7 +36,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -8,8 +8,8 @@
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
 @@ -94,12 +94,5 @@
- 
  # Create file directories and set correct permissions.
+ # hadolint ignore=SC2174 # only the leaf directory needs the mode
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
 -
 -RUN if [ "${VORTEX_FRONTEND_BUILD_SKIP}" != "1" ]; then \
diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_custom/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/theme_custom/.docker/cli.dockerfile
index cf9161fb9..2611497a4 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/theme_custom/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/theme_custom/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -37,7 +37,7 @@
+@@ -36,7 +36,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.docker/cli.dockerfile
index c6e5e90e0..4abfebbec 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -37,7 +37,7 @@
+@@ -36,7 +36,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -8,8 +8,8 @@
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
 @@ -94,12 +94,5 @@
- 
  # Create file directories and set correct permissions.
+ # hadolint ignore=SC2174 # only the leaf directory needs the mode
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
 -
 -RUN if [ "${VORTEX_FRONTEND_BUILD_SKIP}" != "1" ]; then \
diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.docker/cli.dockerfile
index c6e5e90e0..4abfebbec 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -37,7 +37,7 @@
+@@ -36,7 +36,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -8,8 +8,8 @@
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
 @@ -94,12 +94,5 @@
- 
  # Create file directories and set correct permissions.
+ # hadolint ignore=SC2174 # only the leaf directory needs the mode
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
 -
 -RUN if [ "${VORTEX_FRONTEND_BUILD_SKIP}" != "1" ]; then \
diff --git a/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.circleci/config.yml
index 9cd8e6c1b..7fff3cf77 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.circleci/config.yml
index cecc4c619..ffb059d6b 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.circleci/config.yml
index 3f7b66882..fdaceb83a 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.circleci/config.yml
index 4df7b0cd7..3d13c4463 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.docker/cli.dockerfile
index c6e5e90e0..4abfebbec 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -37,7 +37,7 @@
+@@ -36,7 +36,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -8,8 +8,8 @@
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
 @@ -94,12 +94,5 @@
- 
  # Create file directories and set correct permissions.
+ # hadolint ignore=SC2174 # only the leaf directory needs the mode
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
 -
 -RUN if [ "${VORTEX_FRONTEND_BUILD_SKIP}" != "1" ]; then \
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.circleci/config.yml
index 9e8e0e182..cbe6701ad 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.docker/cli.dockerfile
index c6e5e90e0..4abfebbec 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -37,7 +37,7 @@
+@@ -36,7 +36,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -8,8 +8,8 @@
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
 @@ -94,12 +94,5 @@
- 
  # Create file directories and set correct permissions.
+ # hadolint ignore=SC2174 # only the leaf directory needs the mode
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
 -
 -RUN if [ "${VORTEX_FRONTEND_BUILD_SKIP}" != "1" ]; then \
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.circleci/config.yml
index e09916cd2..6ee138d5e 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.circleci/config.yml
index b3b64f38c..0fa9e2c82 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters/.github/workflows/build-test-deploy.yml
index b3361b034..8aa65eaaa 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters/.github/workflows/build-test-deploy.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters/.github/workflows/build-test-deploy.yml
@@ -5,7 +5,7 @@
 -      - name: Lint Dockerfiles with Hadolint
 -        run: |
 -          find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \) | while read -r file; do
--            echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint
+-            echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__
 -          done
 -        continue-on-error: ${{ vars.VORTEX_CI_HADOLINT_IGNORE_FAILURE == '1' }}
 -
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.circleci/config.yml
index d2985ae94..865c9bc80 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.docker/cli.dockerfile
index c6e5e90e0..4abfebbec 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -37,7 +37,7 @@
+@@ -36,7 +36,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -8,8 +8,8 @@
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
 @@ -94,12 +94,5 @@
- 
  # Create file directories and set correct permissions.
+ # hadolint ignore=SC2174 # only the leaf directory needs the mode
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
 -
 -RUN if [ "${VORTEX_FRONTEND_BUILD_SKIP}" != "1" ]; then \
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint/.github/workflows/build-test-deploy.yml
index 4cc322731..3a093813d 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint/.github/workflows/build-test-deploy.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint/.github/workflows/build-test-deploy.yml
@@ -5,7 +5,7 @@
 -      - name: Lint Dockerfiles with Hadolint
 -        run: |
 -          find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \) | while read -r file; do
--            echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint
+-            echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__
 -          done
 -        continue-on-error: ${{ vars.VORTEX_CI_HADOLINT_IGNORE_FAILURE == '1' }}
 -
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.circleci/config.yml
index 3a7418e77..19b98e17b 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.circleci/config.yml
index b6338cc8c..444d786e5 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.circleci/config.yml
index c848b131e..aae1f0f22 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.circleci/config.yml
index d4b7cfbc2..10c334606 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.circleci/config.yml
index a032c7542..30d70baf2 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.circleci/config.yml
index 9cd8e6c1b..7fff3cf77 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.docker/cli.dockerfile
index c6e5e90e0..4abfebbec 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -37,7 +37,7 @@
+@@ -36,7 +36,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -8,8 +8,8 @@
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
 @@ -94,12 +94,5 @@
- 
  # Create file directories and set correct permissions.
+ # hadolint ignore=SC2174 # only the leaf directory needs the mode
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
 -
 -RUN if [ "${VORTEX_FRONTEND_BUILD_SKIP}" != "1" ]; then \
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.circleci/config.yml
index b5645cb5d..7632f0608 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.circleci/config.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.circleci/config.yml
@@ -124,7 +124,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
       - run:
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_none/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_none/.github/workflows/build-test-deploy.yml
index bc59dbdd2..e096e00b7 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_none/.github/workflows/build-test-deploy.yml
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_none/.github/workflows/build-test-deploy.yml
@@ -5,7 +5,7 @@
 -      - name: Lint Dockerfiles with Hadolint
 -        run: |
 -          find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \) | while read -r file; do
--            echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint
+-            echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__
 -          done
 -        continue-on-error: ${{ vars.VORTEX_CI_HADOLINT_IGNORE_FAILURE == '1' }}
 -
diff --git a/.vortex/installer/tests/Functional/Handlers/ToolsHandlerProcessTest.php b/.vortex/installer/tests/Functional/Handlers/ToolsHandlerProcessTest.php
index 0bbead87b..a241ebe18 100644
--- a/.vortex/installer/tests/Functional/Handlers/ToolsHandlerProcessTest.php
+++ b/.vortex/installer/tests/Functional/Handlers/ToolsHandlerProcessTest.php
@@ -194,7 +194,7 @@ public static function dataProviderHandlerProcess(): \Iterator {
           $test->assertFileExists(static::$sut . '/.dclintrc');
           // Dockerfile directives are inert comments that remain useful when
           // the tool is run by hand, so they survive deselection.
-          $test->assertFileContainsString(static::$sut . '/.docker/cli.dockerfile', '# hadolint global ignore=');
+          $test->assertFileContainsString(static::$sut . '/.docker/cli.dockerfile', '# hadolint ignore=');
       }),
     ];
     yield 'tools_no_hadolint_circleci' => [
@@ -209,7 +209,7 @@ public static function dataProviderHandlerProcess(): \Iterator {
           $test->assertFileNotContainsString($ci, 'VORTEX_CI_HADOLINT_IGNORE_FAILURE');
           $test->assertFileContainsString($ci, 'dclint');
           $test->assertFileExists(static::$sut . '/.dclintrc');
-          $test->assertFileContainsString(static::$sut . '/.docker/cli.dockerfile', '# hadolint global ignore=');
+          $test->assertFileContainsString(static::$sut . '/.docker/cli.dockerfile', '# hadolint ignore=');
       }),
     ];
     yield 'tools_no_docker_linters' => [
diff --git a/.vortex/tests/lint.dockerfiles.sh b/.vortex/tests/lint.dockerfiles.sh
index 4f8e2e6fe..cd9037c05 100755
--- a/.vortex/tests/lint.dockerfiles.sh
+++ b/.vortex/tests/lint.dockerfiles.sh
@@ -33,6 +33,6 @@ for file in "${targets[@]}"; do
 
   if [ -f "${file}" ]; then
     echo "Checking file ${file}"
-    docker run --rm -i hadolint/hadolint <"${file}"
+    docker run --rm -i hadolint/hadolint:v2.15.0 <"${file}"
   fi
 done
diff --git a/renovate.json b/renovate.json
index 053415769..bcaeacbe4 100644
--- a/renovate.json
+++ b/renovate.json
@@ -173,7 +173,9 @@
             "groupName": "Container images - All - Major, minor and patch",
             "groupSlug": "container-images-all-major-minor-patch",
             "matchFileNames": [
-                ".docker/**"
+                ".docker/**",
+                ".circleci/**",
+                ".github/workflows/**"
             ],
             "schedule": [
                 "before 3am"
@@ -208,6 +210,18 @@
             ],
             "datasourceTemplate": "docker",
             "versioningTemplate": "docker"
+        },
+        {
+            "customType": "regex",
+            "managerFilePatterns": [
+                "/^\\.circleci/config\\.yml$/",
+                "/^\\.github/workflows/.+\\.yml$/"
+            ],
+            "matchStrings": [
+                "docker run[^\\n]*?\\s(?<depName>[a-z0-9][a-z0-9._\\-]*(?:/[a-z0-9._\\-]+)+):(?<currentValue>v?[0-9][\\w.\\-]*)"
+            ],
+            "datasourceTemplate": "docker",
+            "versioningTemplate": "docker"
         }
     ]
 }