diff --git a/.gitlab/ci/docker/debian10/Dockerfile b/.gitlab/ci/docker/debian10/Dockerfile
index 34a4bf14fd..3ebee876bf 100644
--- a/.gitlab/ci/docker/debian10/Dockerfile
+++ b/.gitlab/ci/docker/debian10/Dockerfile
@@ -16,6 +16,9 @@ MAINTAINER Ben Boeckel <ben.boeckel@kitware.com>
 COPY install_deps.sh /root/install_deps.sh
 RUN sh /root/install_deps.sh
 
+COPY install_clang_tidy.sh /root/install_clang_tidy.sh
+RUN sh /root/install_clang_tidy.sh
+
 COPY --from=iwyu-build /root/iwyu.tar.gz /root/iwyu.tar.gz
 RUN tar -C / -xf /root/iwyu.tar.gz
 RUN ln -s /usr/lib/llvm-6.0/bin/include-what-you-use /usr/bin/include-what-you-use-6.0
diff --git a/.gitlab/ci/docker/debian10/install_clang_tidy.sh b/.gitlab/ci/docker/debian10/install_clang_tidy.sh
new file mode 100755
index 0000000000..1280f1edd4
--- /dev/null
+++ b/.gitlab/ci/docker/debian10/install_clang_tidy.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+set -e
+
+# clang-tidy headers
+apt-get install -y \
+    gnupg2
+GNUPGHOME=$(mktemp -d)
+export GNUPGHOME
+keyid=6084F3CF814B57C1CF12EFD515CF4D18AF4F7421
+gpg2 --keyserver hkps://keyserver.ubuntu.com --recv-keys "$keyid"
+gpg2 -o /usr/share/keyrings/llvm.gpg --export "$keyid"
+rm -rf "$GNUPGHOME"
+unset GNUPGHOME
+echo 'deb [signed-by=/usr/share/keyrings/llvm.gpg] http://apt.llvm.org/buster/ llvm-toolchain-buster-14 main' > /etc/apt/sources.list.d/llvm.list
+apt-get update
+apt-get install -y \
+    clang-tidy-14 \
+    libclang-14-dev
+
+apt-get clean
diff --git a/.gitlab/os-linux.yml b/.gitlab/os-linux.yml
index a46ec2237e..6ac1995bba 100644
--- a/.gitlab/os-linux.yml
+++ b/.gitlab/os-linux.yml
@@ -45,7 +45,7 @@
 ### Debian
 
 .debian10:
-    image: "kitware/cmake:ci-debian10-x86_64-2022-08-30"
+    image: "kitware/cmake:ci-debian10-x86_64-2022-09-22"
 
     variables:
         GIT_CLONE_PATH: "$CI_BUILDS_DIR/cmake ci"