diff --git a/.make/release.mk b/.make/release.mk
index 394ac97f8..bbe7a1fdc 100644
--- a/.make/release.mk
+++ b/.make/release.mk
@@ -13,14 +13,20 @@ release-dirs:
 DOCKER_LDFLAGS += -X "$(OCIS_REPO)/ocis-pkg/config/defaults.BaseDataPathType=path" -X "$(OCIS_REPO)/ocis-pkg/config/defaults.BaseDataPathValue=/var/lib/ocis"
 DOCKER_LDFLAGS += -X "$(OCIS_REPO)/ocis-pkg/config/defaults.BaseConfigPathType=path" -X "$(OCIS_REPO)/ocis-pkg/config/defaults.BaseConfigPathValue=/etc/ocis"
 
+# We can't link statically when vips is enabled but we still
+# prefer static linking where possible
+ifndef ENABLE_VIPS
+	DOCKER_LDFLAGS += -extldflags "-static"
+endif
+
 release-linux-docker-amd64: release-dirs
 	GOOS=linux \
 	GOARCH=amd64 \
 	go build \
-		-tags 'netgo $(TAGS)' \
+		-tags 'netgo,$(TAGS)' \
 		-buildmode=pie \
 		-trimpath \
-		-ldflags '-extldflags "-static" $(LDFLAGS) $(DOCKER_LDFLAGS)' \
+		-ldflags '$(LDFLAGS) $(DOCKER_LDFLAGS)' \
 		-o '$(DIST)/binaries/$(EXECUTABLE)-linux-amd64' \
 		./cmd/$(NAME)
 
@@ -28,9 +34,9 @@ release-linux-docker-arm: release-dirs
 	GOOS=linux \
 	GOARCH=arm \
 	go build \
-		-tags 'netgo $(TAGS)' \
+		-tags 'netgo,$(TAGS)' \
 		-trimpath \
-		-ldflags '-extldflags "-static" $(LDFLAGS) $(DOCKER_LDFLAGS)' \
+		-ldflags '$(LDFLAGS) $(DOCKER_LDFLAGS)' \
 		-o '$(DIST)/binaries/$(EXECUTABLE)-linux-arm' \
 		./cmd/$(NAME)
 
@@ -41,10 +47,10 @@ release-linux-docker-arm64: release-dirs
 	GOOS=linux \
 	GOARCH=arm64 \
 	go build \
-		-tags 'netgo $(TAGS)' \
+		-tags 'netgo,$(TAGS)' \
 		-buildmode=pie \
 		-trimpath \
-		-ldflags '-extldflags "-static" $(LDFLAGS) $(DOCKER_LDFLAGS)' \
+		-ldflags '$(LDFLAGS) $(DOCKER_LDFLAGS)' \
 		-o '$(DIST)/binaries/$(EXECUTABLE)-linux-arm64' \
 		./cmd/$(NAME)
 
@@ -53,7 +59,7 @@ release-linux: release-dirs
 	GOOS=linux \
 	GOARCH=amd64 \
 	go build \
-		-tags 'netgo $(TAGS)' \
+		-tags 'netgo,$(TAGS)' \
 		-buildmode=pie \
 		-trimpath \
 		-ldflags '-extldflags "-static" $(LDFLAGS)' \
@@ -63,7 +69,7 @@ release-linux: release-dirs
 	GOOS=linux \
 	GOARCH=386 \
 	go build \
-		-tags 'netgo $(TAGS)' \
+		-tags 'netgo,$(TAGS)' \
 		-trimpath \
 		-ldflags '-extldflags "-static" $(LDFLAGS)' \
 		-o '$(DIST)/binaries/$(EXECUTABLE)-$(OUTPUT)-linux-386' \
@@ -72,7 +78,7 @@ release-linux: release-dirs
 	GOOS=linux \
 	GOARCH=arm64 \
 	go build \
-		-tags 'netgo $(TAGS)' \
+		-tags 'netgo,$(TAGS)' \
 		-buildmode=pie \
 		-trimpath \
 		-ldflags '-extldflags "-static" $(LDFLAGS)' \
@@ -82,7 +88,7 @@ release-linux: release-dirs
 	GOOS=linux \
 	GOARCH=arm \
 	go build \
-		-tags 'netgo $(TAGS)' \
+		-tags 'netgo,$(TAGS)' \
 		-trimpath \
 		-ldflags '-extldflags "-static" $(LDFLAGS)' \
 		-o '$(DIST)/binaries/$(EXECUTABLE)-$(OUTPUT)-linux-arm' \
@@ -96,7 +102,7 @@ release-darwin: release-dirs
 	GOOS=darwin \
 	GOARCH=amd64 \
 	go build \
-		-tags 'netgo $(TAGS)' \
+		-tags 'netgo,$(TAGS)' \
 		-buildmode=pie \
 		-trimpath \
 		-ldflags '$(LDFLAGS)' \
@@ -106,7 +112,7 @@ release-darwin: release-dirs
 	GOOS=darwin \
 	GOARCH=arm64 \
 	go build \
-		-tags 'netgo $(TAGS)' \
+		-tags 'netgo,$(TAGS)' \
 		-buildmode=pie \
 		-trimpath \
 		-ldflags '$(LDFLAGS)' \
diff --git a/Dockerfile b/Dockerfile
index 5edcc0a5c..ec23f7989 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,11 +26,11 @@ FROM owncloudci/golang:1.22 as build
 COPY --from=generate /ocis /ocis
 
 WORKDIR /ocis/ocis
-RUN make ci-go-generate build
+RUN make ci-go-generate build ENABLE_VIPS=true
 
-FROM alpine:3.18
+FROM alpine:3.20
 
-RUN apk add --no-cache ca-certificates mailcap tree attr curl && \
+RUN apk add --no-cache ca-certificates mailcap tree attr curl vips && \
 	echo 'hosts: files dns' >| /etc/nsswitch.conf
 
 LABEL maintainer="ownCloud GmbH <devops@owncloud.com>" \
diff --git a/ocis/docker/Dockerfile.linux.amd64 b/ocis/docker/Dockerfile.linux.amd64
index ff3cf2eae..581de2d47 100644
--- a/ocis/docker/Dockerfile.linux.amd64
+++ b/ocis/docker/Dockerfile.linux.amd64
@@ -1,9 +1,9 @@
-FROM amd64/alpine:3.18
+FROM amd64/alpine:3.20
 
 ARG VERSION=""
 ARG REVISION=""
 
-RUN apk add --no-cache ca-certificates mailcap tree attr curl inotify-tools bash libc6-compat && \
+RUN apk add --no-cache ca-certificates mailcap tree attr curl inotify-tools bash libc6-compat vips && \
 	echo 'hosts: files dns' >| /etc/nsswitch.conf
 
 LABEL maintainer="ownCloud GmbH <devops@owncloud.com>" \
diff --git a/ocis/docker/Dockerfile.linux.arm64 b/ocis/docker/Dockerfile.linux.arm64
index 3ff8907f0..f154bda51 100644
--- a/ocis/docker/Dockerfile.linux.arm64
+++ b/ocis/docker/Dockerfile.linux.arm64
@@ -1,9 +1,9 @@
-FROM arm64v8/alpine:3.18
+FROM arm64v8/alpine:3.20
 
 ARG VERSION=""
 ARG REVISION=""
 
-RUN apk add --no-cache ca-certificates mailcap tree attr curl inotify-tools bash libc6-compat && \
+RUN apk add --no-cache ca-certificates mailcap tree attr curl inotify-tools bash libc6-compat vips && \
 	echo 'hosts: files dns' >| /etc/nsswitch.conf
 
 LABEL maintainer="ownCloud GmbH <devops@owncloud.com>" \
diff --git a/ocis/docker/Dockerfile.linux.debug.amd64 b/ocis/docker/Dockerfile.linux.debug.amd64
index cbf46d49b..8ee01193e 100644
--- a/ocis/docker/Dockerfile.linux.debug.amd64
+++ b/ocis/docker/Dockerfile.linux.debug.amd64
@@ -3,7 +3,7 @@ FROM amd64/alpine:latest
 ARG VERSION=""
 ARG REVISION=""
 
-RUN apk add --no-cache ca-certificates mailcap tree attr curl libc6-compat delve && \
+RUN apk add --no-cache ca-certificates mailcap tree attr curl inotify-tools bash libc6-compat vips delve && \
 	echo 'hosts: files dns' >| /etc/nsswitch.conf
 
 LABEL maintainer="ownCloud GmbH <devops@owncloud.com>" \