diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 265198d..476fbae 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -51,12 +51,19 @@ jobs:
             - uses: actions/checkout@v7
             - name: Build image
               run: bin/ci/build.sh ${{ matrix.php }} ${{ matrix.node }}
+            - name: Generate token
+              id: generate_token
+              uses: actions/create-github-app-token@v3
+              with:
+                client-id: ${{ secrets.AUTOMATION_CLIENT_ID }}
+                private-key: ${{ secrets.AUTOMATION_CLIENT_SECRET }}
             - name: Test image
               run: bin/ci/test.sh
               continue-on-error: ${{ inputs.force != '' }}
               env:
                 TEST_CMD: "vendor/bin/behat -v --profile=browser --suite=admin-ui --tags=@richtext --config=behat_ibexa_oss.yaml"
                 PRODUCT_VERSION: ${{ matrix.product-version }}
+                COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ steps.generate_token.outputs.token }}"}}'
             - name: Log in to the Container registry
               uses: docker/login-action@v4
               with:
diff --git a/bin/ci/test.sh b/bin/ci/test.sh
index ce5122f..5328e57 100755
--- a/bin/ci/test.sh
+++ b/bin/ci/test.sh
@@ -39,6 +39,7 @@ if [ "$REUSE_VOLUME" = "0" ]; then
     printf "\nBuilding on ibexa_php:latest, composer will implicit check requirements\n"
     docker run -i --rm \
         -e APP_ENV \
+        -e COMPOSER_AUTH \
         -e PHP_INI_ENV_memory_limit=3G \
         -v $(pwd)/volumes/ezplatform:/var/www \
         -v  $COMPOSER_HOME:/root/.composer \
diff --git a/docker/Dockerfile-varnish b/docker/Dockerfile-varnish
index ea56bcb..c9599b2 100644
--- a/docker/Dockerfile-varnish
+++ b/docker/Dockerfile-varnish
@@ -1,4 +1,4 @@
-FROM debian:bullseye-slim
+FROM debian:bookworm-slim
 
 ENV VARNISH_MALLOC_SIZE="256M" \
     DEBIAN_FRONTEND=noninteractive
@@ -21,7 +21,7 @@ RUN set -xe \
             pkg-config \
             python3-docutils \
             sphinx-common \
-            varnish-dev=6.0.12-1~bullseye \
+            varnish-dev=6.0.12-1~bookworm \
         " \
     # Update apt and get dependencies
         && apt-get update -q -y \
@@ -29,7 +29,7 @@ RUN set -xe \
         \
     # Get official Varnish package
         && curl -s ${PACKAGECLOUD_URL} | bash \
-        && apt-get install -q -y --allow-unauthenticated --no-install-recommends varnish=6.0.12-1~bullseye $buildDeps \
+        && apt-get install -q -y --allow-unauthenticated --no-install-recommends varnish=6.0.12-1~bookworm $buildDeps \
         \
     # Install varnish modules
         && curl -A "Docker" -o /tmp/varnish-modules.tar.gz -D - -L -s https://github.com/varnish/varnish-modules/archive/refs/tags/${VARNISH_MODULES_VERSION}.tar.gz \
diff --git a/docker/Dockerfile-varnish7 b/docker/Dockerfile-varnish7
index 78a1148..d929d9d 100644
--- a/docker/Dockerfile-varnish7
+++ b/docker/Dockerfile-varnish7
@@ -1,4 +1,4 @@
-FROM varnish:7.1
+FROM varnish:7.4
 
 # set the user to root, and install build dependencies
 USER root
@@ -7,7 +7,7 @@ RUN set -e; \
     apt-get -y install $VMOD_DEPS /pkgs/*.deb; \
     \
 # install one, possibly multiple vmods
-   install-vmod https://github.com/varnish/varnish-modules/releases/download/0.20.0/varnish-modules-0.20.0.tar.gz; \
+   install-vmod https://github.com/varnish/varnish-modules/releases/download/0.23.0/varnish-modules-0.23.0.tar.gz; \
     \
 # clean up and set the user back to varnish
     rm -rf /var/lib/apt/lists/*
diff --git a/php/Dockerfile-7.3 b/php/Dockerfile-7.3
index 26e9519..a791278 100644
--- a/php/Dockerfile-7.3
+++ b/php/Dockerfile-7.3
@@ -9,8 +9,25 @@ FROM php:7.3-fpm-bullseye
 # Set defaults for variables used by run.sh
 ENV COMPOSER_HOME=/root/.composer
 
+# Debian 11 (bullseye) reached end of LTS on 2026-08-31. Its packages are being
+# removed from deb.debian.org while the indexes still advertise them, so a plain
+# apt-get install fails with sporadic 404s. There is no bookworm variant of this
+# PHP version, so pin apt to a snapshot taken before the EOL instead.
+# Can be dropped once bullseye-security is available on archive.debian.org.
+ARG DEBIAN_SNAPSHOT=20260828T000000Z
+
 # Get packages that we need in container
-RUN apt-get update -q -y \
+RUN set -xe \
+    && printf '%s\n' \
+        "deb https://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main" \
+        "deb https://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye-updates main" \
+        "deb https://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT} bullseye-security main" \
+        > /etc/apt/sources.list \
+    && printf '%s\n' \
+        'Acquire::Check-Valid-Until "false";' \
+        'Acquire::Retries "5";' \
+        > /etc/apt/apt.conf.d/99-debian-snapshot \
+    && apt-get update -q -y \
     && apt-get install -q -y --no-install-recommends \
         ca-certificates \
         curl \
diff --git a/php/Dockerfile-7.4 b/php/Dockerfile-7.4
index 66302e7..04eda82 100644
--- a/php/Dockerfile-7.4
+++ b/php/Dockerfile-7.4
@@ -9,8 +9,25 @@ FROM php:7.4-fpm-bullseye
 # Set defaults for variables used by run.sh
 ENV COMPOSER_HOME=/root/.composer
 
+# Debian 11 (bullseye) reached end of LTS on 2026-08-31. Its packages are being
+# removed from deb.debian.org while the indexes still advertise them, so a plain
+# apt-get install fails with sporadic 404s. There is no bookworm variant of this
+# PHP version, so pin apt to a snapshot taken before the EOL instead.
+# Can be dropped once bullseye-security is available on archive.debian.org.
+ARG DEBIAN_SNAPSHOT=20260828T000000Z
+
 # Get packages that we need in container
-RUN apt-get update -q -y \
+RUN set -xe \
+    && printf '%s\n' \
+        "deb https://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main" \
+        "deb https://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye-updates main" \
+        "deb https://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT} bullseye-security main" \
+        > /etc/apt/sources.list \
+    && printf '%s\n' \
+        'Acquire::Check-Valid-Until "false";' \
+        'Acquire::Retries "5";' \
+        > /etc/apt/apt.conf.d/99-debian-snapshot \
+    && apt-get update -q -y \
     && apt-get install -q -y --no-install-recommends \
         ca-certificates \
         curl \
diff --git a/php/Dockerfile-8.0 b/php/Dockerfile-8.0
index cebcc2e..304448a 100644
--- a/php/Dockerfile-8.0
+++ b/php/Dockerfile-8.0
@@ -5,8 +5,25 @@ FROM php:8.0-fpm-bullseye
 # Set defaults for variables used by run.sh
 ENV COMPOSER_HOME=/root/.composer
 
+# Debian 11 (bullseye) reached end of LTS on 2026-08-31. Its packages are being
+# removed from deb.debian.org while the indexes still advertise them, so a plain
+# apt-get install fails with sporadic 404s. There is no bookworm variant of this
+# PHP version, so pin apt to a snapshot taken before the EOL instead.
+# Can be dropped once bullseye-security is available on archive.debian.org.
+ARG DEBIAN_SNAPSHOT=20260828T000000Z
+
 # Get packages that we need in container
-RUN apt-get update -q -y \
+RUN set -xe \
+    && printf '%s\n' \
+        "deb https://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main" \
+        "deb https://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye-updates main" \
+        "deb https://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT} bullseye-security main" \
+        > /etc/apt/sources.list \
+    && printf '%s\n' \
+        'Acquire::Check-Valid-Until "false";' \
+        'Acquire::Retries "5";' \
+        > /etc/apt/apt.conf.d/99-debian-snapshot \
+    && apt-get update -q -y \
     && apt-get install -q -y --no-install-recommends \
         ca-certificates \
         curl \
diff --git a/php/Dockerfile-8.1 b/php/Dockerfile-8.1
index fcb25df..4d068f7 100644
--- a/php/Dockerfile-8.1
+++ b/php/Dockerfile-8.1
@@ -1,4 +1,4 @@
-FROM php:8.1-fpm-bullseye
+FROM php:8.1-fpm-bookworm
 
 # Container containing php-fpm and php-cli to run and interact with Ibexa DXP
 
@@ -19,7 +19,7 @@ RUN apt-get update -q -y \
         libxpm4 \
         libpng16-16 \
     # intl
-        libicu67 \
+        libicu72 \
     # xslt
         libxslt1.1 \
     # memcached
diff --git a/php/Dockerfile-8.2 b/php/Dockerfile-8.2
index bcd5876..3ed5af6 100644
--- a/php/Dockerfile-8.2
+++ b/php/Dockerfile-8.2
@@ -1,4 +1,4 @@
-FROM php:8.2-fpm-bullseye
+FROM php:8.2-fpm-bookworm
 
 # Container containing php-fpm and php-cli to run and interact with Ibexa DXP
 
@@ -19,7 +19,7 @@ RUN apt-get update -q -y \
         libxpm4 \
         libpng16-16 \
     # intl
-        libicu67 \
+        libicu72 \
     # xslt
         libxslt1.1 \
     # memcached
diff --git a/php/Dockerfile-8.3 b/php/Dockerfile-8.3
index 38259ab..04443d9 100644
--- a/php/Dockerfile-8.3
+++ b/php/Dockerfile-8.3
@@ -1,4 +1,4 @@
-FROM php:8.3-fpm-bullseye
+FROM php:8.3-fpm-bookworm
 
 # Container containing php-fpm and php-cli to run and interact with Ibexa DXP
 
@@ -19,7 +19,7 @@ RUN apt-get update -q -y \
         libxpm4 \
         libpng16-16 \
     # intl
-        libicu67 \
+        libicu72 \
     # xslt
         libxslt1.1 \
     # memcached
diff --git a/php/Dockerfile-8.4 b/php/Dockerfile-8.4
index 51913d1..4226951 100644
--- a/php/Dockerfile-8.4
+++ b/php/Dockerfile-8.4
@@ -1,4 +1,4 @@
-FROM php:8.4-fpm-bullseye
+FROM php:8.4-fpm-bookworm
 
 # Container containing php-fpm and php-cli to run and interact with Ibexa DXP
 
@@ -19,7 +19,7 @@ RUN apt-get update -q -y \
         libxpm4 \
         libpng16-16 \
     # intl
-        libicu67 \
+        libicu72 \
     # xslt
         libxslt1.1 \
     # memcached