diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml
index 93efa11..f10fddd 100644
--- a/.github/workflows/docker-build-push.yml
+++ b/.github/workflows/docker-build-push.yml
@@ -16,16 +16,25 @@ jobs:
   build:
     runs-on: ubuntu-latest
 
+    strategy:
+      fail-fast: false
+      matrix:
+        debian_suite: [bookworm, trixie]
+
     steps:
       - name: Checkout code
         uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
+        with:
+          persist-credentials: false
 
       - name: Extract versions from Dockerfile
         id: versions
+        env:
+          DEBIAN_SUITE: ${{ matrix.debian_suite }}
         run: |
           RUST_VERSION=$(grep -E '^[[:space:]]*RUST_VERSION=' Dockerfile | head -1 | cut -d'=' -f2)
           NODE_VERSION=$(grep -E '^ENV NODE_VERSION=' Dockerfile | head -1 | cut -d'=' -f2)
-          IMAGE_VERSION="bookworm_rust_${RUST_VERSION}-node_${NODE_VERSION}"
+          IMAGE_VERSION="${DEBIAN_SUITE}_rust_${RUST_VERSION}-node_${NODE_VERSION}"
           echo "rust_version=${RUST_VERSION}" >> $GITHUB_OUTPUT
           echo "node_version=${NODE_VERSION}" >> $GITHUB_OUTPUT
           echo "image_version=${IMAGE_VERSION}" >> $GITHUB_OUTPUT
@@ -33,11 +42,11 @@ jobs:
           echo "Image version: ${IMAGE_VERSION}"
 
       - name: Validate extracted versions
+        env:
+          RUST_VERSION: ${{ steps.versions.outputs.rust_version }}
+          NODE_VERSION: ${{ steps.versions.outputs.node_version }}
+          IMAGE_VERSION: ${{ steps.versions.outputs.image_version }}
         run: |
-          RUST_VERSION="${{ steps.versions.outputs.rust_version }}"
-          NODE_VERSION="${{ steps.versions.outputs.node_version }}"
-          IMAGE_VERSION="${{ steps.versions.outputs.image_version }}"
-
           # Check RUST_VERSION is not empty and matches version pattern
           if [ -z "$RUST_VERSION" ]; then
             echo "::error::Failed to extract RUST_VERSION from Dockerfile"
@@ -59,7 +68,7 @@ jobs:
           fi
 
           # Validate final image version format
-          if ! echo "$IMAGE_VERSION" | grep -qE '^bookworm_rust_[0-9]+\.[0-9]+-node_[0-9]+\.[0-9]+\.[0-9]+$'; then
+          if ! echo "$IMAGE_VERSION" | grep -qE '^(bookworm|trixie)_rust_[0-9]+\.[0-9]+-node_[0-9]+\.[0-9]+\.[0-9]+$'; then
             echo "::error::IMAGE_VERSION '$IMAGE_VERSION' does not match expected format"
             exit 1
           fi
@@ -80,14 +89,20 @@ jobs:
         run: |
           # Build and tag the Docker image with the version
           docker buildx create --use
-          if [ "${{ github.event_name }}" = "push" ]; then
+          if [ "$EVENT_NAME" = "push" ]; then
             docker buildx build --push \
-              --tag ghcr.io/$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]'):${{ steps.versions.outputs.image_version }} \
+              --build-arg "DEBIAN_SUITE=$DEBIAN_SUITE" \
+              --tag "ghcr.io/$(echo "$REPOSITORY" | tr '[:upper:]' '[:lower:]'):$IMAGE_VERSION" \
               --platform linux/amd64,linux/arm64 .
           else
             docker buildx build \
+              --build-arg "DEBIAN_SUITE=$DEBIAN_SUITE" \
               --platform linux/amd64,linux/arm64 .
           fi
 
         env:
           DOCKER_CLI_ACI_AS_TEXT: "true"
+          EVENT_NAME: ${{ github.event_name }}
+          REPOSITORY: ${{ github.repository }}
+          IMAGE_VERSION: ${{ steps.versions.outputs.image_version }}
+          DEBIAN_SUITE: ${{ matrix.debian_suite }}
diff --git a/Dockerfile b/Dockerfile
index 40e26dc..6dac2bc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,6 @@
-FROM buildpack-deps:bookworm
+# Debian suite to build against (e.g. bookworm or trixie)
+ARG DEBIAN_SUITE=trixie
+FROM buildpack-deps:${DEBIAN_SUITE}
 
 # ----------------------
 # rust 1.91 via https://github.com/rust-lang/docker-rust/blob/3b6565cd3b0b7c9cb084f07461cb959f7cf77c16/1.80.1/bookworm/Dockerfile