diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 978e84b..9a16b0d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -23,7 +23,7 @@ jobs:
       matrix: # match with maven-enforcer-plugin rules in pom.xml
         include:
           - name: build-arg
-            version: 17.0.10_p7
+            version: 17.0.11_p9
           - name: implicit
             version: master
     steps:
diff --git a/Dockerfile b/Dockerfile
index 7c6305e..4a475d4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,7 +6,7 @@
 # docker_parent_image is the base layer of full and jre image
 #
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/alpine
-ARG docker_parent_image=ghcr.io/openzipkin/alpine:3.19.1
+ARG docker_parent_image=ghcr.io/openzipkin/alpine:3.20.0
 
 # java_version and java_home are hard-coded here to allow the following:
 #  * `docker build https://github.com/openzipkin/docker-java.git`
@@ -17,7 +17,7 @@ ARG docker_parent_image=ghcr.io/openzipkin/alpine:3.19.1
 # When updating, also update the README
 #  * Use current version from https://pkgs.alpinelinux.org/packages?name=openjdk17, stripping
 #    the `-rX` at the end.
-ARG java_version=17.0.10_p7
+ARG java_version=17.0.11_p9
 ARG java_home=/usr/lib/jvm/java-17-openjdk
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
diff --git a/README.md b/README.md
index aa5d996..a82e54e 100644
--- a/README.md
+++ b/README.md
@@ -15,10 +15,10 @@ This is an internal base layer primarily used in [zipkin](https://github.com/ope
 
 To try the image, run the `java -version` command:
 ```bash
-$ docker run --rm ghcr.io/openzipkin/java:17.0.10_p7 -version
-openjdk version "17.0.10" 2024-01-16
-OpenJDK Runtime Environment (build 17.0.10+7-alpine-r0)
-OpenJDK 64-Bit Server VM (build 17.0.10+7-alpine-r0, mixed mode, sharing)
+$ docker run --rm ghcr.io/openzipkin/java:17.0.11_p9 -version
+openjdk version "17.0.11" 2024-04-16
+OpenJDK Runtime Environment (build 17.0.11+9-alpine-r0)
+OpenJDK 64-Bit Server VM (build 17.0.11+9-alpine-r0, mixed mode, sharing)
 ```
 
 ## Release process
@@ -39,19 +39,19 @@ Build the [Dockerfile](Dockerfile) using the current version without the
 revision classifier from here:
  * https://pkgs.alpinelinux.org/packages?name=openjdk17
 ```bash
-# Note 17.0.10_p7 not 17.0.10_p7-r0!
-./build-bin/build 17.0.10_p7
+# Note 17.0.11_p9 not 17.0.11_p9-r0!
+./build-bin/build 17.0.11_p9
 ```
 
 Next, verify the built image matches that version:
 ```bash
 $ docker run --rm openzipkin/java:test -version
-openjdk version "17.0.10" 2024-01-16
-OpenJDK Runtime Environment (build 17.0.10+7-alpine-r0)
-OpenJDK 64-Bit Server VM (build 17.0.10+7-alpine-r0, mixed mode, sharing)
+openjdk version "17.0.11" 2024-04-16
+OpenJDK Runtime Environment (build 17.0.11+9-alpine-r0)
+OpenJDK 64-Bit Server VM (build 17.0.11+9-alpine-r0, mixed mode, sharing)
 ```
 
-To release the image, push a tag matching the arg to `build-bin/build` (ex `17.0.10_p7`).
+To release the image, push a tag matching the arg to `build-bin/build` (ex `17.0.11_p9`).
 This triggers a [GitHub Actions](https://github.com/openzipkin/docker-java/actions) job to push the image.
 
 ## java.lang.ClassNotFoundException
diff --git a/build-bin/docker/docker_args b/build-bin/docker/docker_args
index 3b4fdb0..570f3aa 100755
--- a/build-bin/docker/docker_args
+++ b/build-bin/docker/docker_args
@@ -46,7 +46,7 @@ if [ -n "${DOCKER_TARGET}" ]; then
 fi
 
 # When non-empty, becomes the base layer including tag appropriate for the image being built.
-# e.g. ghcr.io/openzipkin/java:17.0.10_p7-jre
+# e.g. ghcr.io/openzipkin/java:17.0.11_p9-jre
 #
 # This is not required to be a base (FROM scratch) image like ghcr.io/openzipkin/alpine:3.12.3
 # See https://docs.docker.com/glossary/#parent-image
@@ -60,7 +60,7 @@ if [ -n "${ALPINE_VERSION}" ]; then
   docker_args="${docker_args} --build-arg alpine_version=${ALPINE_VERSION}"
 fi
 
-# When non-empty, becomes the build-arg java_version. e.g. "17.0.10_p7"
+# When non-empty, becomes the build-arg java_version. e.g. "17.0.11_p9"
 # Used to align base layers from https://github.com/orgs/openzipkin/packages/container/package/java
 if [ -n "${JAVA_VERSION}" ]; then
   docker_args="${docker_args} --build-arg java_version=${JAVA_VERSION}"