diff --git a/CHANGES.md b/CHANGES.md
index 825ec11..ccf8a79 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -13,6 +13,9 @@
   * Failing tests should ideally be fixed. If that isn't possible --- no
     control over upstream, or tests require hardware access --- they can be
     disabled by setting the environment variable `SKIP_TESTS` to  `1`.
+* base: update to Debian 12. by @ericonr in
+  https://github.com/cnpem/epics-in-docker/pull/84
+  * Refer to up to date README for new/updated `RUNTIME_PACKAGES`.
 
 ## v0.12.0
 
diff --git a/Dockerfile b/Dockerfile
index 66a62f2..127fa09 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-ARG DEBIAN_VERSION=11.9
+ARG DEBIAN_VERSION=12.8
 
 FROM ghcr.io/cnpem/lnls-debian-epics-7:v0.12.0-dev AS build-image
 
@@ -15,6 +15,7 @@ COPY --from=build-image /etc/apt/apt.conf.d/90-disable-sandbox.conf /etc/apt/apt
 RUN apt update -y && \
     apt install -y --no-install-recommends \
         libreadline8 \
+        libtirpc3 \
         busybox \
         netcat-openbsd \
         procserv \
diff --git a/README.md b/README.md
index add2bc5..672d6bf 100644
--- a/README.md
+++ b/README.md
@@ -95,7 +95,7 @@ hardware access), the `SKIP_TESTS` argument can be set to `1`.
 ### areaDetector IOCs
 
 `areaDetector` IOCs must be built with target `dynamic-link`. In addition, they
-must include `libxml2` and `libtiff5` in the `RUNTIME_PACKAGES`, as they are
+must include `libxml2` and `libtiff6` in the `RUNTIME_PACKAGES`, as they are
 not built in `ADSupport`.
 
 ### Pmac IOCs
diff --git a/base/Dockerfile b/base/Dockerfile
index 7d71d38..1c39ab4 100644
--- a/base/Dockerfile
+++ b/base/Dockerfile
@@ -25,6 +25,7 @@ RUN apt update -y && \
         libxml2-dev \
         libsnmp-dev \
         libssl-dev \
+        libtirpc-dev \
         re2c \
         unzip \
         wget \
@@ -55,7 +56,7 @@ WORKDIR ${EPICS_MODULES_PATH}
 
 COPY backport-ipmicomm.patch ipmicomm.patch caputlog-waveform-fix.patch $EPICS_IN_DOCKER
 COPY modules_versions.sh install_modules.sh $EPICS_IN_DOCKER
-RUN $EPICS_IN_DOCKER/install_modules.sh
+RUN NEEDS_TIRPC=YES $EPICS_IN_DOCKER/install_modules.sh
 
 COPY backport-adsupport-nanohttp.patch $EPICS_IN_DOCKER
 COPY area_detector_versions.sh install_area_detector.sh $EPICS_IN_DOCKER
diff --git a/base/docker-compose.yml b/base/docker-compose.yml
index 4dcd596..5201a5c 100644
--- a/base/docker-compose.yml
+++ b/base/docker-compose.yml
@@ -10,4 +10,4 @@ services:
         org.opencontainers.image.description: "EPICS base and modules build image"
       args:
         JOBS: ${JOBS:--1}
-        DEBIAN_VERSION: 11.9
+        DEBIAN_VERSION: 12.8
diff --git a/images/docker-compose-opcua.yml b/images/docker-compose-opcua.yml
index 3ea3aef..95dfc34 100644
--- a/images/docker-compose-opcua.yml
+++ b/images/docker-compose-opcua.yml
@@ -10,4 +10,4 @@ services:
       args:
         REPONAME: opcua
         RUNDIR: /opt/epics/modules/opcua/iocBoot/iocUaDemoServer
-        RUNTIME_PACKAGES: libxml2 libssl1.1
+        RUNTIME_PACKAGES: libxml2 libssl3