diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 5afa638..350e441 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -7,7 +7,7 @@ name: deploy
 # See https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet
 on:
   push:
-    tags: '[0-9]+.[0-9]+.[0-9]+**'  # Ex. 8.272.10 or 17.0.7_p7
+    tags: '[0-9]+.[0-9]+.[0-9]+**'  # Ex. 8.272.10 or 17.0.8_p7
 
 jobs:
   deploy:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9e00f35..04705c0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -25,6 +25,6 @@ jobs:
       # We can't cache Docker without using buildx because GH actions restricts /var/lib/docker
       # That's ok because DOCKER_PARENT_IMAGE is always ghcr.io and local anyway.
       - name: Test LTS JDK
-        run: build-bin/configure_test && build-bin/test 17.0.7_p7
+        run: build-bin/configure_test && build-bin/test 17.0.8_p7
       - name: Test latest JDK
         run: build-bin/configure_test && build-bin/test
diff --git a/.travis.yml b/.travis.yml
index 915c573..52b771e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -19,7 +19,7 @@ before_install: |  # Prevent test build of a documentation-only change.
 install: ./build-bin/configure_test
 script:
   # Test LTS JDK
-  - ./build-bin/test 17.0.7_p7
+  - ./build-bin/test 17.0.8_p7
   # Test latest JDK
   - ./build-bin/test
 
diff --git a/Dockerfile b/Dockerfile
index c68df26..9ca6b67 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,7 +6,7 @@
 # docker_parent_image is the base layer of full and jre image
 #
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/alpine
-ARG docker_parent_image=ghcr.io/openzipkin/alpine:3.18.0
+ARG docker_parent_image=ghcr.io/openzipkin/alpine:3.18.2
 
 # java_version is hard-coded here to allow the following to work:
 #  * `docker build https://github.com/openzipkin/docker-java.git`
@@ -14,7 +14,7 @@ ARG docker_parent_image=ghcr.io/openzipkin/alpine:3.18.0
 # When updating, also update the README
 #  * Use current version from https://pkgs.alpinelinux.org/packages?name=openjdk17, stripping
 #    the `-rX` at the end.
-ARG java_version=17.0.7_p7
+ARG java_version=17.0.8_p7
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker-compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -50,7 +50,7 @@ ENTRYPOINT ["java", "-jar"]
 FROM base as jdk
 LABEL org.opencontainers.image.description="OpenJDK on Alpine Linux"
 ARG java_version
-ARG maven_version=3.6.3
+ARG maven_version=3.8.8
 LABEL maven-version=$maven_version
 
 COPY --from=code /code/install.sh .
diff --git a/README.md b/README.md
index 95cd81c..1666299 100644
--- a/README.md
+++ b/README.md
@@ -15,7 +15,7 @@ This is an internal base layer primarily used in [zipkin](https://github.com/ope
 
 To try the image, run the `java -version` command:
 ```bash
-docker run --rm ghcr.io/openzipkin/java:17.0.7_p7 -version
+docker run --rm ghcr.io/openzipkin/java:17.0.8_p7 -version
 openjdk version "17.0.5" 2022-10-18
 OpenJDK Runtime Environment (build 17.0.5+8-alpine-r2)
 OpenJDK 64-Bit Server VM (build 17.0.5+8-alpine-r2, mixed mode, sharing)
@@ -25,8 +25,8 @@ OpenJDK 64-Bit Server VM (build 17.0.5+8-alpine-r2, mixed mode, sharing)
 Build the `Dockerfile` using the current version without the revision classifier from here:
  * https://pkgs.alpinelinux.org/packages?name=openjdk15
 ```bash
-# Note 17.0.7_p7 not 17.0.7_p7-r0!
-./build-bin/build 17.0.7_p7
+# Note 17.0.8_p7 not 17.0.8_p7-r0!
+./build-bin/build 17.0.8_p7
 ```
 
 Next, verify the built image matches that version:
@@ -37,5 +37,5 @@ OpenJDK Runtime Environment (build 17.0.5+8-alpine-r2)
 OpenJDK 64-Bit Server VM (build 17.0.5+8-alpine-r2, mixed mode, sharing)
 ```
 
-To release the image, push a tag matching the arg to `build-bin/build` (ex `17.0.7_p7`).
+To release the image, push a tag matching the arg to `build-bin/build` (ex `17.0.8_p7`).
 This triggers a [GitHub Actions](https://github.com/openzipkin/docker-java/actions) job to push the image.
diff --git a/build-bin/README.md b/build-bin/README.md
index b098e49..2090c25 100644
--- a/build-bin/README.md
+++ b/build-bin/README.md
@@ -141,7 +141,7 @@ explicitly defined and `on.tags` is a [glob pattern](https://docs.github.com/en/
 ```yaml
 on:
   push:
-    tags: '[0-9]+.[0-9]+.[0-9]+**'  # Ex. 8.272.10 or 17.0.7_p7
+    tags: '[0-9]+.[0-9]+.[0-9]+**'  # Ex. 8.272.10 or 17.0.8_p7
     branches: master
 
 jobs:
@@ -203,7 +203,7 @@ jobs:
         - if [ "${SHOULD_DEPLOY}" != "true" ]; then travis_terminate 0; fi
         - travis_wait ./build-bin/deploy master
     - stage: deploy
-      # Ex. 8.272.10 or 17.0.7_p7
+      # Ex. 8.272.10 or 17.0.8_p7
       if: tag =~ /^[0-9]+\.[0-9]+\.[0-9]+/ AND type = push AND env(GH_TOKEN) IS present
       install: ./build-bin/configure_deploy
       script: ./build-bin/deploy ${TRAVIS_TAG}
diff --git a/build-bin/docker/docker_args b/build-bin/docker/docker_args
index c070798..0a6f58b 100755
--- a/build-bin/docker/docker_args
+++ b/build-bin/docker/docker_args
@@ -46,7 +46,7 @@ if [ -n "${DOCKER_TARGET}" ]; then
 fi
 
 # When non-empty, becomes the base layer including tag appropriate for the image being built.
-# Ex. ghcr.io/openzipkin/java:17.0.7_p7-jre
+# Ex. ghcr.io/openzipkin/java:17.0.8_p7-jre
 #
 # This is not required to be a base (FROM scratch) image like ghcr.io/openzipkin/alpine:3.12.3
 # See https://docs.docker.com/glossary/#parent-image
@@ -60,7 +60,7 @@ if [ -n "${ALPINE_VERSION}" ]; then
   docker_args="${docker_args} --build-arg alpine_version=${ALPINE_VERSION}"
 fi
 
-# When non-empty, becomes the build-arg java_version. Ex. "17.0.7_p7"
+# When non-empty, becomes the build-arg java_version. Ex. "17.0.8_p7"
 # Used to align base layers from https://github.com/orgs/openzipkin/packages/container/package/java
 if [ -n "${JAVA_VERSION}" ]; then
   docker_args="${docker_args} --build-arg java_version=${JAVA_VERSION}"
diff --git a/install.sh b/install.sh
index 6282d70..8e72d08 100755
--- a/install.sh
+++ b/install.sh
@@ -27,7 +27,7 @@ function maybe_log_crash() {
   (cat $(ls hs_err_pid*.log) 2>&- || true) && exit 1;
 }
 
-java_version=${1?java_version is required. ex 17.0.7_p7}
+java_version=${1?java_version is required. ex 17.0.8_p7}
 maven_version=${2?maven_version is required. ex 3.6.3}
 java_major_version=$(echo ${java_version}| cut -f1 -d .)
 package=openjdk${java_major_version}