After upstream package updates happen these images should be rebuild to contain the newest (and most secure) versions. Alternatively a daily build would work too. Build system can be at 25th-floor inhouse, or maybe TravisCI is also a good solution.