diff --git a/.github/scripts/prepare-matrices.py b/.github/scripts/prepare-matrices.py
index 596a63a5..76acca44 100644
--- a/.github/scripts/prepare-matrices.py
+++ b/.github/scripts/prepare-matrices.py
@@ -47,6 +47,18 @@ def get_latest_version(subdir, channel_name):
         return get_latest_version_sh(os.path.join(subdir, channel_name, "latest.sh"), channel_name)
     return None
 
+def get_latest_package_version(subdir, channel_name):
+    ci_dir =  os.path.join(subdir, "ci")
+    if os.path.isfile(os.path.join(ci_dir, "pkgver.py")):
+        return get_latest_version_py(os.path.join(ci_dir, "pkgver.py"), channel_name)
+    elif os.path.isfile(os.path.join(ci_dir, "pkgver.sh")):
+        return get_latest_version_sh(os.path.join(ci_dir, "pkgver.sh"), channel_name)
+    elif os.path.isfile(os.path.join(subdir, channel_name, "pkgver.py")):
+        return get_latest_version_py(os.path.join(subdir, channel_name, "pkgver.py"), channel_name)
+    elif os.path.isfile(os.path.join(subdir, channel_name, "pkgver.sh")):
+        return get_latest_version_sh(os.path.join(subdir, channel_name, "pkgver.sh"), channel_name)
+    return None
+
 def get_published_version(image_name):
     r = requests.get(
         f"https://api.github.com/users/{repo_owner}/packages/container/{image_name}/versions",
@@ -99,6 +111,7 @@ def get_image_metadata(subdir, meta, forRelease=False, force=False, channels=Non
             toBuild["published_version"] = published
 
         toBuild["version"] = version
+        toBuild["pkgver"] = get_latest_package_version(subdir, channel["name"])
 
         # Image Tags
         toBuild["tags"] = ["rolling", version]
@@ -126,6 +139,7 @@ def get_image_metadata(subdir, meta, forRelease=False, force=False, channels=Non
             platformToBuild["target_arch"] = target_arch
             platformToBuild["version"] = version
             platformToBuild["channel"] = channel["name"]
+            platformToBuild["pkgver"] = toBuild["pkgver"]
 
             if meta.get("base", False):
                 platformToBuild["label_type"] ="org.opencontainers.image.base"
diff --git a/.github/workflows/build-images.yaml b/.github/workflows/build-images.yaml
index b7a8b6b2..b2d8f28a 100644
--- a/.github/workflows/build-images.yaml
+++ b/.github/workflows/build-images.yaml
@@ -190,6 +190,7 @@ jobs:
         with:
           build-args: |-
             VERSION=${{ matrix.image.version }}
+            PKGVER=${{ matrix.image.pkgver }}
             REVISION=${{ github.sha }}
             CHANNEL=${{ matrix.image.channel }}
           context: . # TODO: Use ${{ matrix.image.context }}, requires updates to all dockerfiles :-(
diff --git a/.gitignore b/.gitignore
index 6acfffe6..59c8181d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
+ignore/**
 .goss
 .private
 **/*.pyc
diff --git a/apps/samba-debian/Dockerfile b/apps/samba-debian/Dockerfile
index a425a18b..12bfb0dd 100644
--- a/apps/samba-debian/Dockerfile
+++ b/apps/samba-debian/Dockerfile
@@ -1,8 +1,6 @@
-ARG VERSION
-
 FROM public.ecr.aws/docker/library/debian:12.2-slim
-ARG VERSION
-RUN apt update && apt install -y samba=${VERSION} ctdb=${VERSION} winbind=${VERSION} samba-vfs-modules=${VERSION} catatonit && apt clean && rm -rf /var/lib/apt/lists && rm -rf /var/cache
+ARG PKGVER
+RUN apt update && apt install -y samba=${PKGVER} ctdb=${PKGVER} winbind=${PKGVER} samba-vfs-modules=${PKGVER} catatonit && apt clean && rm -rf /var/lib/apt/lists && rm -rf /var/cache
 # TODO: if CephFS kernel mount (PVC) not working as expected, switch to Debian unstable and install libcephfs2 for vfs_ceph, all other Debian versions are wildly out of date
 
 USER 0:0
diff --git a/apps/samba-debian/ci/latest.sh b/apps/samba-debian/ci/latest.sh
index b370034d..b131602b 100755
--- a/apps/samba-debian/ci/latest.sh
+++ b/apps/samba-debian/ci/latest.sh
@@ -1,6 +1,10 @@
 #!/usr/bin/env bash
 #version="$(curl -sX GET "https://gitlab.nic.cz/labs/bird/-/raw/master/NEWS" 2>/dev/null | awk '/Version/{print $2}' 2>/dev/null | head -n 1 2>/dev/null)"
-version="$(curl -sX GET "https://salsa.debian.org/samba-team/samba/-/raw/bookworm/debian/changelog" 2>/dev/null | head -n 1 | awk -F'[()]' '{print $2}')"
+UPSTREAM=$(curl -sX GET "https://salsa.debian.org/samba-team/samba/-/raw/bookworm/VERSION" 2>/dev/null | grep -v "#")
+MAJOR=$(echo "${UPSTREAM}" | awk -F'=' '/SAMBA_VERSION_MAJOR/{print $2}')
+MINOR=$(echo "${UPSTREAM}" | awk -F'=' '/SAMBA_VERSION_MINOR/{print $2}')
+RELEASE=$(echo "${UPSTREAM}" | awk -F'=' '/SAMBA_VERSION_RELEASE/{print $2}')
+version="${MAJOR}.${MINOR}.${RELEASE}"
 version="${version#*v}"
 version="${version#*release-}"
 printf "%s" "${version}"
diff --git a/apps/samba-debian/ci/pkgver.sh b/apps/samba-debian/ci/pkgver.sh
new file mode 100755
index 00000000..b370034d
--- /dev/null
+++ b/apps/samba-debian/ci/pkgver.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+#version="$(curl -sX GET "https://gitlab.nic.cz/labs/bird/-/raw/master/NEWS" 2>/dev/null | awk '/Version/{print $2}' 2>/dev/null | head -n 1 2>/dev/null)"
+version="$(curl -sX GET "https://salsa.debian.org/samba-team/samba/-/raw/bookworm/debian/changelog" 2>/dev/null | head -n 1 | awk -F'[()]' '{print $2}')"
+version="${version#*v}"
+version="${version#*release-}"
+printf "%s" "${version}"