diff --git a/.github/workflows/base-image.yml b/.github/workflows/base-image.yml
index f082c66..6a8a230 100644
--- a/.github/workflows/base-image.yml
+++ b/.github/workflows/base-image.yml
@@ -17,7 +17,7 @@ jobs:
     strategy:
       matrix:
         image:
-          - { dir: base, name: lnls-debian-11-epics-7 }
+          - { dir: base, name: lnls-debian-12-epics-7 }
           - { dir: base/musl, name: lnls-alpine-3-epics-7 }
     env:
       TAG: ${{ github.event_name == 'push' && github.ref_name || github.head_ref }}
diff --git a/Dockerfile b/Dockerfile
index dd31b90..74fc29f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
-ARG DEBIAN_VERSION=11.9
+ARG DEBIAN_VERSION=12.7
 
-FROM ghcr.io/cnpem/lnls-debian-11-epics-7:v0.12.0-dev AS build-image
+FROM ghcr.io/cnpem/lnls-debian-12-epics-7:v0.12.0-dev AS build-image
 
 FROM debian:${DEBIAN_VERSION}-slim AS base
 
@@ -15,6 +15,7 @@ COPY --from=build-image /etc/apt/apt.conf.d/90-disable-sandbox.conf /etc/apt/apt
 RUN apt update -y && \
     apt install -y --no-install-recommends \
         libreadline8 \
+        libtirpc3 \
         busybox \
         netcat-openbsd \
         procserv \
diff --git a/README.md b/README.md
index 9ee8fb5..ab60b43 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ build thin IOC container images.
 ## Base image
 
 The base image is built in CI and should be obtained directly from the [GitHub
-registry](https://github.com/cnpem/epics-in-docker/pkgs/container/lnls-debian-11-epics-7).
+registry](https://github.com/cnpem/epics-in-docker/pkgs/container/lnls-debian-12-epics-7).
 
 The versions used in the base image are defined in `base/.env`.
 
@@ -88,7 +88,7 @@ image should be tagged as `latest`, `:${TAG}` can simply be omitted.
 ### areaDetector IOCs
 
 `areaDetector` IOCs must be built with target `dynamic-link`. In addition, they
-must include `libxml2` and `libtiff5` in the `RUNTIME_PACKAGES`, as they are
+must include `libxml2` and `libtiff6` in the `RUNTIME_PACKAGES`, as they are
 not built in `ADSupport`.
 
 ### Pmac IOCs
diff --git a/base/.env b/base/.env
index f145fdd..cb36984 100644
--- a/base/.env
+++ b/base/.env
@@ -1,4 +1,4 @@
-DEBIAN_VERSION=11.9
+DEBIAN_VERSION=12.7
 ALPINE_VERSION=3.20.3
 
 EPICS7_BASE_VERSION=7.0.8.1
diff --git a/base/Dockerfile b/base/Dockerfile
index aeae2ec..136cee1 100644
--- a/base/Dockerfile
+++ b/base/Dockerfile
@@ -25,6 +25,7 @@ RUN apt update -y && \
         libxml2-dev \
         libsnmp-dev \
         libssl-dev \
+        libtirpc-dev \
         re2c \
         unzip \
         wget \
@@ -74,7 +75,7 @@ COPY backport-ipmicomm.patch .
 COPY ipmicomm.patch .
 COPY caputlog-waveform-fix.patch .
 COPY install_modules.sh .
-RUN ./install_modules.sh
+RUN NEEDS_TIRPC=YES ./install_modules.sh
 
 ARG AREA_DETECTOR_VERSION
 ARG NDSSCPIMEGA_VERSION
diff --git a/base/docker-compose.yml b/base/docker-compose.yml
index 9dc7445..82ea932 100644
--- a/base/docker-compose.yml
+++ b/base/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   epics-base:
-    image: ${REGISTRY:-ghcr.io/cnpem}/lnls-debian-11-epics-7:$TAG
+    image: ${REGISTRY:-ghcr.io/cnpem}/lnls-debian-12-epics-7:$TAG
     build:
       context: ./
       dockerfile: Dockerfile
diff --git a/images/docker-compose-opcua.yml b/images/docker-compose-opcua.yml
index b7322c9..eac29fe 100644
--- a/images/docker-compose-opcua.yml
+++ b/images/docker-compose-opcua.yml
@@ -10,4 +10,4 @@ services:
       args:
         REPONAME: opcua
         RUNDIR: /opt/epics/modules/opcua/iocBoot/iocUaDemoServer
-        RUNTIME_PACKAGES: libxml2 libssl1.1
+        RUNTIME_PACKAGES: libxml2 libssl3