diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..9d0161a
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright (C) 2026 Northwestern University.
+#
+# Documentation: https://docs.github.com/en/code-security/dependabot
+
+version: 2
+updates:
+
+  # Enable version updates for GitHub actions
+  - package-ecosystem: "github-actions"
+    # Exception as per documentation: "/" means to look for any files in `.github/workflows/`
+    directory: "/"
+    # Check for updates once a week on Monday
+    schedule:
+      interval: "weekly"
diff --git a/README.md b/README.md
index 2911350..f33d365 100644
--- a/README.md
+++ b/README.md
@@ -2,46 +2,51 @@
 
 [![Build Status](https://github.com/inveniosoftware/docker-invenio/workflows/CI/badge.svg)](https://github.com/inveniosoftware/docker-invenio/actions)
 
-This image serves as base image, usable in production environments like Kubernetes or OpenShift, for:
+This repository defines the Dockerfiles for the foundational Docker images usable in production environments like Docker Compose, Kubernetes, OpenShift, or other container orchestrators.
+These Dockerfiles are for any Invenio-based app:
 * [InvenioRDM](https://github.com/inveniosoftware/invenio-app-rdm)
 * [InvenioILS](https://github.com/inveniosoftware/invenio-app-ils)
 * [Invenio](https://github.com/inveniosoftware/invenio)
 
-Previous images, still available in this repository for reference only, were based on `CentOS`: after the [shift from CentOS to CentOS Stream](https://blog.centos.org/2020/12/future-is-centos-stream/), the main image is now based on [AlmaLinux](https://almalinux.org/), a free alternative downstream rebuild of Red Hat Enterprise Edition.
+## Provided images
+
+The provided images are the ones supported by CERN and/or an Invenio partner organization.
 
-The [current image](almalinux/Dockerfile) is based on the AlmaLinux version 9 and contains:
+| Operating System | Dockerfile FROM                                   | Supporting organization                                    |
+| ---------------- | ------------------------------------------------- | ---------------------------------------------------------- |
+| AlmaLinux - v9   | FROM registry.cern.ch/inveniosoftware/almalinux:1 | CERN (@ntarocco)                                           |
+| Debian - trixie  | FROM TBD                                          | Northwestern University (@fenekku), Frontmatter (@mfenner) |
+|                  |                                                   |                                                            |
 
-- Python v3.9 set as default Python interpreter with upgraded versions of pip, pipenv, setuptools and wheel.
-- Node.js v22.x
-- Working directory for an Invenio instance.
+All images provide a common baseline of:
+- Python and uv versions
+- Node, npm and pnpm version
+- development headers for all Invenio dependencies
+- "invenio" user with uid 1000
+- /opt/invenio/ working directory and appropriate subdirectories
 
-Images are currently published in the CERN registry `registry.cern.ch`.
+Previous images, still available in this repository for reference only, were based on `CentOS`: after the [shift from CentOS to CentOS Stream](https://blog.centos.org/2020/12/future-is-centos-stream/), the main image is now based on [AlmaLinux](https://almalinux.org/), a free alternative downstream rebuild of Red Hat Enterprise Edition.
 
 ## Usage
 
 ### Create a ``Dockerfile``
 
-A simple ``Dockerfile`` using this base image could look like this:
+Your own simple ``Dockerfile`` using one of the base image would look like this:
 
-```
-FROM registry.cern.ch/inveniosoftware/almalinux:latest
+```dockerfile
+# Select the FROM line, you want. For AlmaLinux, it would be:
+FROM registry.cern.ch/inveniosoftware/almalinux:1
 ```
 
-### Rolling builds
+### Build and run the Docker image
 
-The images are rebuilt when the base images are updated. The base image are receiving regular monthly
-updates as well as emergency fixes.
+To test the Docker image locally, you can build it and run it by doing:
 
-### Local builds
-
-To test the Dockerimage locally, you can build it and run it by doing:
-
-```
-cd almalinux
-docker build . -t almalinux:1
-docker run -it almalinux:1 /bin/bash
+```bash
+docker build . -t my-image:1
+docker run -it my-image:1 /bin/bash
 ```
 
 ## Optimization
 
-You can use a tool like [dive](https://github.com/wagoodman/dive) to explore the layers of the Docker images and optimize it.
+You can use a tool like [dive](https://github.com/wagoodman/dive) to explore the layers of the Docker images and optimize it in your own Dockerfile.
diff --git a/debian/Dockerfile b/debian/Dockerfile
new file mode 100644
index 0000000..5d02e9f
--- /dev/null
+++ b/debian/Dockerfile
@@ -0,0 +1,92 @@
+# syntax=docker/dockerfile:1
+
+#
+# Copyright (C) 2026 Northwestern University.
+# Copyright (C) 2026 Frontmatter.
+# Copyright (C) 2026 KTH Royal Institute of Technology.
+#
+# Invenio is free software; you can redistribute it and/or modify it
+# under the terms of the MIT License; see LICENSE file for more details.
+#
+
+ARG BUILD_PLATFORM=linux/amd64
+ARG PYTHON_VERSION=3.14
+ARG OS_VERSION=trixie
+ARG NODE_VERSION=24
+
+FROM --platform=${BUILD_PLATFORM} python:${PYTHON_VERSION}-${OS_VERSION}
+
+LABEL org.opencontainers.image.source=https://github.com/inveniosoftware/docker-invenio
+
+ENV \
+    WORKING_DIR=/opt/invenio \
+    INVENIO_INSTANCE_PATH=/opt/invenio/var/instance \
+    INVENIO_USER_ID=1000 \
+    PATH=${WORKING_DIR}/src/.venv/bin:${PATH}
+
+# Create relevant application directories
+RUN mkdir -p \
+    ${WORKING_DIR}/src \
+    ${INVENIO_INSTANCE_PATH}/data \
+    ${INVENIO_INSTANCE_PATH}/archive \
+    ${INVENIO_INSTANCE_PATH}/static
+
+# Invenio file will be in <WORKING_DIR>/src
+WORKDIR ${WORKING_DIR}/src
+
+# Set folder permissions
+RUN chgrp -R 0 ${WORKING_DIR} && \
+    chmod -R g=u ${WORKING_DIR} && \
+    useradd invenio --uid ${INVENIO_USER_ID} --gid 0 && \
+    chown -R invenio:root ${WORKING_DIR}
+
+# Install system dependencies
+#  The --mount=type=cache helps cache local builds and
+#  will only yield a benefit to a CI if the CI also
+#  preserves filesystem between runs
+#
+#  InvenioRDM requires the following packages that Debian already provides
+#    ca-certificates
+#    curl
+#    gcc
+#    git
+#    imagemagick
+#    libbz2-dev
+#    libcairo2
+#    libffi-dev
+#    liblzma-dev
+#    libpq-dev
+#    libssl-dev
+#    libsqlite3-dev
+#    libxml2-dev
+#    libxslt1-dev
+RUN \
+    --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    apt-get update && apt-get upgrade --yes \
+    && \
+    # Install Node.js deb source
+    curl -fsSL https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - \
+    && \
+    # Install system dependencies
+    apt-get install --yes --no-install-recommends \
+        build-essential \
+        fonts-dejavu \
+        locales \
+        nodejs \
+        npm \
+    && \
+    # Install pnpm
+    npm install -g pnpm@latest-10
+
+# Setup uv
+# From https://docs.astral.sh/uv/guides/integration/docker/
+# but using docker.io/astral/uv because failure to fetch oauth token
+COPY --from=docker.io/astral/uv:0.11 /uv /uvx /bin/
+
+# Set locale
+RUN localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8
+ENV \
+    LANG=en_US.UTF-8 \
+    LANGUAGE=en_US:en \
+    LC_ALL=en_US.UTF-8