diff --git a/.docker/wordpress/Dockerfile b/.docker/wordpress/Dockerfile
index 133759a..109861a 100644
--- a/.docker/wordpress/Dockerfile
+++ b/.docker/wordpress/Dockerfile
@@ -1,6 +1,7 @@
 ARG VERSION_WORDPRESS
 ARG VERSION_PHP
-FROM wordpress:${VERSION_WORDPRESS}-php${VERSION_PHP}-fpm
+ARG WORDPRESS_BASE_IMAGE=wordpress:${VERSION_WORDPRESS}-php${VERSION_PHP}-fpm
+FROM ${WORDPRESS_BASE_IMAGE}
 
 RUN apt-get update
 RUN apt-get install -y \
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 1e68340..26577a7 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -1,12 +1,18 @@
 name: Docker WordPress Publish
 
 on:
+  pull_request:
+    branches:
+      - main
   push:
     branches:
       - main
   workflow_dispatch:
-  schedule:
-    - cron: '0 2 * * *'
+    inputs:
+      wordpress_base_image:
+        description: 'Override the official WordPress base image (version and PHP series)'
+        required: false
+        type: string
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -17,8 +23,7 @@ jobs:
     name: Build and push image
     runs-on: ubuntu-latest
     env:
-      VERSION_WORDPRESS: "7.1.3"
-      VERSION_PHP: "8.3"
+      WORDPRESS_BASE_IMAGE: wordpress:7.1.3-php8.3-fpm@sha256:788d6b34cb89997483ff2a08e2e04d1df28ce284ca046cd7990b0be10828c5b9
     permissions:
       contents: read
       packages: write
@@ -42,6 +47,7 @@ jobs:
             wordpress-buildx-
 
       - name: Log in to GitHub Container Registry
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -54,10 +60,10 @@ jobs:
           context: .docker/wordpress
           file: .docker/wordpress/Dockerfile
           platforms: linux/amd64,linux/arm64
+          pull: true
           push: false
           build-args: |
-            VERSION_WORDPRESS=${{ env.VERSION_WORDPRESS }}
-            VERSION_PHP=${{ env.VERSION_PHP }}
+            WORDPRESS_BASE_IMAGE=${{ inputs.wordpress_base_image || env.WORDPRESS_BASE_IMAGE }}
           tags: |
             ghcr.io/librecodecoop/wordpress-docker:${{ github.sha }}
           cache-from: type=local,src=/tmp/.buildx-cache
@@ -70,10 +76,10 @@ jobs:
           context: .docker/wordpress
           file: .docker/wordpress/Dockerfile
           platforms: linux/amd64,linux/arm64
+          pull: true
           push: true
           build-args: |
-            VERSION_WORDPRESS=${{ env.VERSION_WORDPRESS }}
-            VERSION_PHP=${{ env.VERSION_PHP }}
+            WORDPRESS_BASE_IMAGE=${{ inputs.wordpress_base_image || env.WORDPRESS_BASE_IMAGE }}
           tags: |
             ghcr.io/librecodecoop/wordpress-docker:${{ github.sha }}
             ghcr.io/librecodecoop/wordpress-docker:latest
diff --git a/common-services.yml b/common-services.yml
index b8c2e4b..1d45bfc 100644
--- a/common-services.yml
+++ b/common-services.yml
@@ -4,7 +4,7 @@ services:
     # build:
     #   context: .docker/wordpress
     #   args:
-    #     VERSION_WORDPRESS: ${VERSION_WORDPRESS:-6.9}
+    #     VERSION_WORDPRESS: ${VERSION_WORDPRESS:-7.1.3}
     #     VERSION_PHP: ${VERSION_PHP:-8.3}
     restart: unless-stopped
     volumes:
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..1ac139d
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,37 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "enabledManagers": [
+    "custom.regex"
+  ],
+  "dependencyDashboard": false,
+  "separateMinorPatch": true,
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^\\.github\\/workflows\\/docker-publish\\.yml$/"
+      ],
+      "matchStrings": [
+        "WORDPRESS_BASE_IMAGE: wordpress:(?<currentValue>\\d+\\.\\d+\\.\\d+-php\\d+\\.\\d+-fpm)@(?<currentDigest>sha256:[a-f0-9]{64})"
+      ],
+      "datasourceTemplate": "docker",
+      "depNameTemplate": "wordpress",
+      "versioningTemplate": "docker"
+    }
+  ],
+  "packageRules": [
+    {
+      "matchManagers": [
+        "custom.regex"
+      ],
+      "matchPackageNames": [
+        "wordpress"
+      ],
+      "matchUpdateTypes": [
+        "major",
+        "minor"
+      ],
+      "enabled": false
+    }
+  ]
+}
diff --git a/tests/security/image-version-selection.bats b/tests/security/image-version-selection.bats
new file mode 100644
index 0000000..e56dd7e
--- /dev/null
+++ b/tests/security/image-version-selection.bats
@@ -0,0 +1,22 @@
+#!/usr/bin/env bats
+
+setup() {
+  cd "$BATS_TEST_DIRNAME/../.."
+}
+
+@test "WordPress and PHP versions remain selectable" {
+  grep -Fxq 'ARG VERSION_WORDPRESS' .docker/wordpress/Dockerfile
+  grep -Fxq 'ARG VERSION_PHP' .docker/wordpress/Dockerfile
+  grep -Fxq 'ARG WORDPRESS_BASE_IMAGE=wordpress:${VERSION_WORDPRESS}-php${VERSION_PHP}-fpm' .docker/wordpress/Dockerfile
+  grep -Fxq 'FROM ${WORDPRESS_BASE_IMAGE}' .docker/wordpress/Dockerfile
+}
+
+@test "CI defaults to Renovate-managed image and allows an override" {
+  run grep -Fc 'WORDPRESS_BASE_IMAGE=${{ inputs.wordpress_base_image || env.WORDPRESS_BASE_IMAGE }}' .github/workflows/docker-publish.yml
+  [ "$status" -eq 0 ]
+  [ "$output" -eq 2 ]
+
+  run grep -Ec 'WORDPRESS_BASE_IMAGE: wordpress:[0-9]+\.[0-9]+\.[0-9]+-php[0-9]+\.[0-9]+-fpm@sha256:[a-f0-9]{64}' .github/workflows/docker-publish.yml
+  [ "$status" -eq 0 ]
+  [ "$output" -eq 1 ]
+}