diff --git a/benchmarks/src/test/java/zipkin2/server/ServerIntegratedBenchmark.java b/benchmarks/src/test/java/zipkin2/server/ServerIntegratedBenchmark.java
index 55670aa3d2..a1c4337c2d 100644
--- a/benchmarks/src/test/java/zipkin2/server/ServerIntegratedBenchmark.java
+++ b/benchmarks/src/test/java/zipkin2/server/ServerIntegratedBenchmark.java
@@ -277,7 +277,7 @@ GenericContainer<?> createZipkinContainer(@Nullable GenericContainer<?> storage)
 
     final GenericContainer<?> zipkin;
     if (RELEASE_VERSION == null) {
-      zipkin = new GenericContainer<>(parse("ghcr.io/openzipkin/java:21.0.2_p13"));
+      zipkin = new GenericContainer<>(parse("ghcr.io/openzipkin/java:21.0.3_p9"));
       List<String> classpath = new ArrayList<>();
       for (String item : System.getProperty("java.class.path").split(File.pathSeparator)) {
         Path path = Paths.get(item);
diff --git a/build-bin/docker-compose-zipkin.yml b/build-bin/docker-compose-zipkin.yml
index fd65174ac2..3a2e293831 100755
--- a/build-bin/docker-compose-zipkin.yml
+++ b/build-bin/docker-compose-zipkin.yml
@@ -14,7 +14,7 @@ services:
   # Use fixed service and container name 'sut; so our test script can copy/pasta
   sut:
     container_name: sut
-    image: ghcr.io/openzipkin/alpine:3.19.1
+    image: ghcr.io/openzipkin/alpine:3.20.0
     entrypoint: /bin/sh
     # Keep the container running until HEALTHCHECK passes
     command: "-c \"sleep 5m\""
diff --git a/build-bin/docker/docker_args b/build-bin/docker/docker_args
index e61f0dcbe7..1ebdb54fe3 100755
--- a/build-bin/docker/docker_args
+++ b/build-bin/docker/docker_args
@@ -37,7 +37,7 @@ if [ -n "${DOCKER_TARGET}" ]; then
 fi
 
 # When non-empty, becomes the base layer including tag appropriate for the image being built.
-# e.g. ghcr.io/openzipkin/java:21.0.2_p13-jre
+# e.g. ghcr.io/openzipkin/java:21.0.3_p9-jre
 #
 # This is not required to be a base (FROM scratch) image like ghcr.io/openzipkin/alpine:3.12.3
 # See https://docs.docker.com/glossary/#parent-image
@@ -51,7 +51,7 @@ if [ -n "${ALPINE_VERSION}" ]; then
   docker_args="${docker_args} --build-arg alpine_version=${ALPINE_VERSION}"
 fi
 
-# When non-empty, becomes the build-arg java_version. e.g. "21.0.2_p13"
+# When non-empty, becomes the build-arg java_version. e.g. "21.0.3_p9"
 # Used to align base layers from https://github.com/orgs/openzipkin/packages/container/package/java
 if [ -n "${JAVA_VERSION}" ]; then
   docker_args="${docker_args} --build-arg java_version=${JAVA_VERSION}"
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 3213830d35..b0af1afcf7 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -8,7 +8,7 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.2_p13
+ARG java_version=21.0.3_p9
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker-compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
diff --git a/docker/test-images/zipkin-activemq/Dockerfile b/docker/test-images/zipkin-activemq/Dockerfile
index 59f7933d71..2e4ab7167f 100644
--- a/docker/test-images/zipkin-activemq/Dockerfile
+++ b/docker/test-images/zipkin-activemq/Dockerfile
@@ -8,7 +8,7 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.2_p13
+ARG java_version=21.0.3_p9
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker-compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -23,7 +23,7 @@ FROM ghcr.io/openzipkin/java:${java_version} as install
 WORKDIR /install
 
 # Use latest version from https://activemq.apache.org/components/classic/download/
-ARG activemq_version=6.1.1
+ARG activemq_version=6.1.2
 
 # Download the distribution
 RUN \
@@ -37,7 +37,7 @@ https://archive.apache.org/dist/activemq/${activemq_version}/apache-activemq-${a
 # which isn't in our JRE.
 FROM ghcr.io/openzipkin/java:${java_version} as zipkin-activemq
 LABEL org.opencontainers.image.description="ActiveMQ Classic on OpenJDK and Alpine Linux"
-ARG activemq_version=6.1.1
+ARG activemq_version=6.1.2
 LABEL activemq-version=$activemq_version
 
 # Add HEALTHCHECK and ENTRYPOINT scripts into the default search path
diff --git a/docker/test-images/zipkin-cassandra/Dockerfile b/docker/test-images/zipkin-cassandra/Dockerfile
index b1940f1a15..f84a6bcd7e 100644
--- a/docker/test-images/zipkin-cassandra/Dockerfile
+++ b/docker/test-images/zipkin-cassandra/Dockerfile
@@ -8,7 +8,7 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.2_p13
+ARG java_version=21.0.3_p9
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker-compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -25,7 +25,7 @@ FROM ghcr.io/openzipkin/java:${java_version} as install
 # Use latest stable version: https://cassandra.apache.org/download/
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG cassandra_version=4.1.4
+ARG cassandra_version=4.1.5
 ENV CASSANDRA_VERSION=$cassandra_version
 WORKDIR /install
 
@@ -35,7 +35,7 @@ RUN /tmp/install.sh && rm /tmp/install.sh
 
 FROM ghcr.io/openzipkin/java:${java_version}-jre as zipkin-cassandra
 LABEL org.opencontainers.image.description="Cassandra on OpenJDK and Alpine Linux with Zipkin keyspaces pre-installed"
-ARG cassandra_version=4.1.4
+ARG cassandra_version=4.1.5
 LABEL cassandra-version=$cassandra_version
 ENV CASSANDRA_VERSION=$cassandra_version
 
diff --git a/docker/test-images/zipkin-cassandra/install.sh b/docker/test-images/zipkin-cassandra/install.sh
index 8f00088784..60c8ef3e92 100755
--- a/docker/test-images/zipkin-cassandra/install.sh
+++ b/docker/test-images/zipkin-cassandra/install.sh
@@ -172,19 +172,22 @@ is_cassandra_alive || exit 1
 echo "*** Installing cqlsh"
 # cqlsh 4.x is not compatible with Python 3.12 by default.
 # See https://issues.apache.org/jira/browse/CASSANDRA-19206
-python3_version=3.11
+python3_version=3.12
 apk add --update --no-cache python3=~${python3_version}
 # Installing cqlsh requires cffi package. Normally this doesn't need
 # to be compiled, but something isn't right with aarch64 when installing
 # cqlsh it needs to build cffi. To unblock support for aarch64, adding
 # the following are necessary for compiling cffi. If pip someday changes and
 # doesn't compile cffi on aarch64 then we can remove these dependencies.
-apk add --update --no-cache gcc python3-dev=~${python3_version} musl-dev libffi-dev
+# libev is required when using python 3.12
+# TODO: remove git when https://github.com/jeffwidman/cqlsh/pull/37 is released
+apk add --update --no-cache gcc python3-dev=~${python3_version} musl-dev libffi-dev libev libev-dev git
 # PEP 668 protects against mixing system and pip packages. Setup virtual env to avoid this.
 python3 -m venv .venv
 . .venv/bin/activate
 python3 -m ensurepip --upgrade
-pip install -Iq cqlsh
+# TODO: just cqlsh when https://github.com/jeffwidman/cqlsh/pull/37 is released
+pip install -Iq git+https://github.com/jeffwidman/cqlsh@master
 cql() {
   cqlsh "$@" 127.0.0.1 ${temp_native_transport_port}
 }
diff --git a/docker/test-images/zipkin-elasticsearch7/Dockerfile b/docker/test-images/zipkin-elasticsearch7/Dockerfile
index 2ce08ddb7f..05a31019d4 100644
--- a/docker/test-images/zipkin-elasticsearch7/Dockerfile
+++ b/docker/test-images/zipkin-elasticsearch7/Dockerfile
@@ -8,7 +8,7 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.2_p13
+ARG java_version=21.0.3_p9
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker-compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -26,7 +26,7 @@ WORKDIR /install
 # Use latest 7.x version from https://www.elastic.co/downloads/past-releases#elasticsearch-no-jdk
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG elasticsearch7_version=7.17.20
+ARG elasticsearch7_version=7.17.21
 
 # Download only the OSS distribution (lacks X-Pack)
 RUN \
@@ -41,7 +41,7 @@ COPY --from=scratch /config/ ./config/
 # production -jre base layer used by zipkin and zipkin-slim.
 FROM ghcr.io/openzipkin/java:${java_version} as zipkin-elasticsearch7
 LABEL org.opencontainers.image.description="Elasticsearch distribution on OpenJDK and Alpine Linux"
-ARG elasticsearch7_version=7.17.20
+ARG elasticsearch7_version=7.17.21
 LABEL elasticsearch-version=$elasticsearch7_version
 
 # The full license is also included in the image at /elasticsearch/LICENSE.txt.
diff --git a/docker/test-images/zipkin-elasticsearch8/Dockerfile b/docker/test-images/zipkin-elasticsearch8/Dockerfile
index 8c786af804..fdd85f03dc 100644
--- a/docker/test-images/zipkin-elasticsearch8/Dockerfile
+++ b/docker/test-images/zipkin-elasticsearch8/Dockerfile
@@ -8,7 +8,7 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.2_p13
+ARG java_version=21.0.3_p9
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker-compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -26,7 +26,7 @@ WORKDIR /install
 # Use latest 8.x version from https://www.elastic.co/downloads/past-releases#elasticsearch
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG elasticsearch8_version=8.13.2
+ARG elasticsearch8_version=8.13.4
 
 # Download only the OSS distribution (lacks X-Pack)
 RUN \
@@ -41,7 +41,7 @@ COPY --from=scratch /config/ ./config/
 # production -jre base layer used by zipkin and zipkin-slim.
 FROM ghcr.io/openzipkin/java:${java_version} as zipkin-elasticsearch8
 LABEL org.opencontainers.image.description="Elasticsearch distribution on OpenJDK and Alpine Linux"
-ARG elasticsearch8_version=8.13.2
+ARG elasticsearch8_version=8.13.4
 LABEL elasticsearch-version=$elasticsearch8_version
 
 # The full license is also included in the image at /elasticsearch/LICENSE.txt.
diff --git a/docker/test-images/zipkin-eureka/Dockerfile b/docker/test-images/zipkin-eureka/Dockerfile
index 2ace26d49d..5de7caee54 100644
--- a/docker/test-images/zipkin-eureka/Dockerfile
+++ b/docker/test-images/zipkin-eureka/Dockerfile
@@ -8,7 +8,7 @@
 # Use latest version here: https://github.com/orgs/openeureka/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.2_p13
+ARG java_version=21.0.3_p9
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker-compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
diff --git a/docker/test-images/zipkin-eureka/pom.xml b/docker/test-images/zipkin-eureka/pom.xml
index 615e217501..cdca7274bb 100644
--- a/docker/test-images/zipkin-eureka/pom.xml
+++ b/docker/test-images/zipkin-eureka/pom.xml
@@ -29,7 +29,7 @@
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
-        <version>3.2.5</version>
+        <version>3.2.6</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
diff --git a/docker/test-images/zipkin-kafka/Dockerfile b/docker/test-images/zipkin-kafka/Dockerfile
index 4d62fdf977..2d40dc763a 100644
--- a/docker/test-images/zipkin-kafka/Dockerfile
+++ b/docker/test-images/zipkin-kafka/Dockerfile
@@ -8,7 +8,7 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.2_p13
+ARG java_version=21.0.3_p9
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker-compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
diff --git a/docker/test-images/zipkin-mysql/Dockerfile b/docker/test-images/zipkin-mysql/Dockerfile
index e1a7058798..8403b545f8 100644
--- a/docker/test-images/zipkin-mysql/Dockerfile
+++ b/docker/test-images/zipkin-mysql/Dockerfile
@@ -6,7 +6,7 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/alpine
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG alpine_version=3.19.1
+ARG alpine_version=3.20.0
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker-compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
diff --git a/docker/test-images/zipkin-opensearch2/Dockerfile b/docker/test-images/zipkin-opensearch2/Dockerfile
index add5a71b90..7669171a0e 100644
--- a/docker/test-images/zipkin-opensearch2/Dockerfile
+++ b/docker/test-images/zipkin-opensearch2/Dockerfile
@@ -8,7 +8,7 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.2_p13
+ARG java_version=21.0.3_p9
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker-compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -26,7 +26,7 @@ WORKDIR /install
 # Use latest 2.x version from https://opensearch.org/downloads.html
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG opensearch2_version=2.13.0
+ARG opensearch2_version=2.14.0
 
 # Download only the OSS distribution (lacks X-Pack)
 RUN \
@@ -41,7 +41,7 @@ COPY --from=scratch /config/ ./config/
 # production -jre base layer used by zipkin and zipkin-slim.
 FROM ghcr.io/openzipkin/java:${java_version} as zipkin-opensearch2
 LABEL org.opencontainers.image.description="OpenSearch distribution on OpenJDK and Alpine Linux"
-ARG opensearch2_version=2.13.0
+ARG opensearch2_version=2.14.0
 LABEL opensearch-version=$opensearch2_version
 
 # The full license is also included in the image at /opensearch/LICENSE.txt.
diff --git a/docker/test-images/zipkin-rabbitmq/Dockerfile b/docker/test-images/zipkin-rabbitmq/Dockerfile
index e4b7a6ade5..71d7e66ea7 100644
--- a/docker/test-images/zipkin-rabbitmq/Dockerfile
+++ b/docker/test-images/zipkin-rabbitmq/Dockerfile
@@ -4,7 +4,7 @@
 #
 
 # Use latest from https://hub.docker.com/_/rabbitmq/tags?page=1&name=alpine
-ARG rabbitmq_version=3.13.1
+ARG rabbitmq_version=3.13.2
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker-compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
diff --git a/docker/test-images/zipkin-ui/Dockerfile b/docker/test-images/zipkin-ui/Dockerfile
index 40596a00f8..9c03242bc3 100644
--- a/docker/test-images/zipkin-ui/Dockerfile
+++ b/docker/test-images/zipkin-ui/Dockerfile
@@ -6,14 +6,14 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/alpine
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG alpine_version=3.19.1
+ARG alpine_version=3.20.0
 
 # java_version is used during the installation process to build or download the zipkin-lens jar.
 #
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.2_p13
+ARG java_version=21.0.3_p9
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker-compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -52,7 +52,7 @@ RUN if [ "${RELEASE_FROM_MAVEN_BUILD}" == "false" ]; then /build-bin/maybe_insta
 FROM ghcr.io/openzipkin/alpine:$alpine_version as zipkin-ui
 LABEL org.opencontainers.image.description="NGINX on Alpine Linux hosting the Zipkin UI with Zipkin API proxy_pass"
 # Use latest from https://pkgs.alpinelinux.org/packages?name=nginx
-ARG nginx_version=1.24.0
+ARG nginx_version=1.26.0
 LABEL nginx-version=$nginx_version
 
 ENV ZIPKIN_BASE_URL=http://zipkin:9411
diff --git a/docker/test-images/zipkin-uiproxy/Dockerfile b/docker/test-images/zipkin-uiproxy/Dockerfile
index 9698f4032c..1b8f34d73f 100644
--- a/docker/test-images/zipkin-uiproxy/Dockerfile
+++ b/docker/test-images/zipkin-uiproxy/Dockerfile
@@ -6,14 +6,14 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/alpine
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG alpine_version=3.19.1
+ARG alpine_version=3.20.0
 
 # java_version is used during the installation process to build or download the zipkin-lens jar.
 #
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.2_p13
+ARG java_version=21.0.3_p9
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker-compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -28,7 +28,7 @@ COPY docker/test-images/zipkin-uiproxy/nginx.conf /conf.d/zipkin.conf.template
 FROM ghcr.io/openzipkin/alpine:$alpine_version as zipkin-uiproxy
 LABEL org.opencontainers.image.description="NGINX on Alpine Linux proxying the Zipkin UI with proxy_pass"
 # Use latest from https://pkgs.alpinelinux.org/packages?name=nginx
-ARG nginx_version=1.24.0
+ARG nginx_version=1.26.0
 LABEL nginx-version=$nginx_version
 
 ENV ZIPKIN_UI_BASEPATH=/zipkin