diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index f65b1f9..912561c 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -9,7 +9,7 @@ build:
   before_script:
     - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
   script:
-    - docker build -t "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" -t "$CI_REGISTRY_IMAGE:latest" .
+    - docker build --pull -t "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" -t "$CI_REGISTRY_IMAGE:latest" .
     - docker push --all-tags "$CI_REGISTRY_IMAGE"
   rules:
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
diff --git a/Dockerfile b/Dockerfile
index 4ca79d4..ea43086 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,12 +1,17 @@
 FROM alpine:latest
 
+# ponytail: resolves latest upstream release at build time via the /releases/latest redirect
+# (no GitHub API rate limit); pin WEBHOOK_VERSION if a release ever breaks.
+ARG WEBHOOK_VERSION=latest
 RUN apk add --no-cache \
     curl \
     docker-cli \
     docker-cli-compose && \
-    wget -O /usr/local/bin/webhook \
-      https://github.com/adnanh/webhook/releases/download/2.8.2/webhook-linux-amd64 && \
-    chmod +x /usr/local/bin/webhook
+    v="$WEBHOOK_VERSION" && \
+    [ "$v" != latest ] || v=$(basename "$(curl -sIL -o /dev/null -w '%{url_effective}' https://github.com/adnanh/webhook/releases/latest)") && \
+    curl -fsSL "https://github.com/adnanh/webhook/releases/download/$v/webhook-linux-amd64.tar.gz" \
+      | tar xz --strip-components=1 -C /usr/local/bin webhook-linux-amd64/webhook && \
+    webhook -version
 
 EXPOSE 9000
 ENTRYPOINT ["webhook"]