diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 15d332fc..e579253b 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -27,7 +27,7 @@ jobs:
       stacks: ${{ steps.config.outputs.stacks }}
       build: ${{ steps.config.outputs.build }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.after }}
       - name: Configure build
@@ -100,7 +100,7 @@ jobs:
       STACK: ${{ matrix.stack }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Show config
         run: make show-args
diff --git a/Makefile b/Makefile
index c27fe8b2..7803b909 100644
--- a/Makefile
+++ b/Makefile
@@ -98,6 +98,8 @@ endef
 # Generate convenience targets for all supported stacks.
 $(foreach img,$(image_stacks),$(eval $(call stack,$(img))))
 
+export TEXLIVE_MIRROR_URL
+
 # Freeze ################################################################
 .PHONY: freeze-file
 freeze-file: $(STACK)/$(stack_freeze_file)
@@ -112,7 +114,7 @@ freeze-file: $(STACK)/$(stack_freeze_file)
 		$(docker_cpu_options)
 	docker run --rm \
 		-v "$(makefile_dir):/app" \
-	  --env WITHOUT_CROSSREF=$(WITHOUT_CROSSREF) \
+		--env WITHOUT_CROSSREF=$(WITHOUT_CROSSREF) \
 		pandoc/$(STACK)-builder-base:latest-$(STACK) \
 		sh /app/common/pandoc-freeze.sh \
 		    -c $(PANDOC_COMMIT) \
diff --git a/README.md b/README.md
index 4a686b24..402122a5 100644
--- a/README.md
+++ b/README.md
@@ -107,49 +107,6 @@ Basic Usage
    the next time. You don't have to worry about where/how Docker keeps these
    images.
 
-Pandoc Scripts
---------------------------------------------------------------------------------
-
-Pandoc commands have a way of getting pretty long, and so typing them into the
-command line can get a little unwieldy. To get a better handle of long pandoc
-commands, you can store them in a script file, a simple text file with an `*.sh`
-extension such as
-
-```sh
-#!/bin/sh
-pandoc README.md
-```
-
-The first line, known as the [*shebang*](https://stackoverflow.com/q/7366775)
-tells the container that the following commands are to be executed as shell
-commands. In our case, we really don't use a lot of shell magic, we just call
-pandoc in the second line (though you can get fancier, if you like). Notice that
-the `#!/bin/sh` will *not* get you a full bash shell, but only the more basic
-ash shell that comes with Alpine linux on which the pandoc containers are based.
-This won't matter for most uses, but if you want to write writing more
-complicated scripts you may want to refer to the [`ash`
-manual](https://linux.die.net/man/1/ash).
-
-Once you have stored this script, you must make it executable by running the
-following command on it (this may apply only to UNIX-type systems):
-
-```sh
-chmod +x script.sh
-```
-
-You only have to do this once for each script file.
-
-You can then run the completed script file in a pandoc docker container like so:
-
-```sh
-docker run --rm --volume "`pwd`:/data" --entrypoint "/data/script.sh" pandoc/latex:2.6
-```
-
-Notice that the above `script.sh` *did* specify `pandoc`, and you can't just
-omit it as in the simpler command above. This is because the `--entrypoint` flag
-*overrides* the `ENTRYPOINT` field in the docker file (`pandoc`, in our case),
-so you must include the command.
-
 GitHub Actions
 --------------------------------------------------------------------------------
 
@@ -195,6 +152,34 @@ Started guide](https://docs.docker.com/get-started/part2/).
 
 [spellcheck](https://github.com/pandoc/lua-filters/tree/master/spellcheck)
 
+### Internationalized LaTeX images
+
+This very method can be used to create images with support for
+additional fonts. This is of particular importance for the processing of
+documents written in a language that uses non-Latin characters.
+
+Below is an example Dockerfile that can be used to build a custom image with
+support for Ukrainian. It adds the necessary LaTeX packages via `tlmgr` and
+installs *Linux Libertine* as a font with support for Cyrillic.
+
+``` Dockerfile
+FROM pandoc/latex
+RUN tlmgr install babel-ukrainian
+RUN apk --no-cache add font-linux-libertine
+```
+
+After building a new image as described in the previous section, the
+image can then be used to convert documents such as:
+
+``` markdown
+---
+title: "Приклад українською"
+mainfont: Linux Libertine
+lang: uk
+---
+
+Цей текст не дуже цікавий.
+```
 
 License
 ================================================================================
diff --git a/alpine/Dockerfile b/alpine/Dockerfile
index 6394e253..0fec824c 100644
--- a/alpine/Dockerfile
+++ b/alpine/Dockerfile
@@ -103,6 +103,7 @@ FROM alpine-core as alpine-latex
 
 # NOTE: to maintainers, please keep this listing alphabetical.
 RUN apk --no-cache add \
+        curl \
         fontconfig \
         freetype \
         gnupg \
@@ -135,9 +136,15 @@ COPY common/latex/packages.txt /root/packages.txt
 # TeXLive version to install (leave empty to use the latest version).
 ARG texlive_version=
 
+# TeXLive mirror URL (leave empty to use the default mirror).
+ARG texlive_mirror_url=
+
 # Request musl precompiled binary access
 RUN echo "binary_x86_64-linuxmusl 1" >> /root/texlive.profile \
-  && /root/install-texlive.sh $texlive_version \
+  && ( \
+     [ -z "$texlive_version"    ] || printf '-t\n%s\n"' "$texlive_version"; \
+     [ -z "$texlive_mirror_url" ] || printf '-m\n%s\n' "$texlive_mirror_url" \
+     ) | xargs /root/install-texlive.sh \
   && sed -e 's/ *#.*$//' -e '/^ *$/d' /root/packages.txt | \
      xargs tlmgr install \
   && rm -f /root/texlive.profile \
@@ -151,20 +158,19 @@ WORKDIR /data
 # extra ##############################################################
 FROM alpine-latex as alpine-extra
 
-COPY common/latex/texlive.profile /root/texlive.profile
 COPY common/extra/packages.txt /root/extra_packages.txt
 COPY common/extra/requirements.txt /root/extra_requirements.txt
 
-RUN apk --no-cache add py-pip
+# The option `--break-system-packages` sounds bad but this is not 
+# really a problem here because we are not using Python apk packages
+# anyway.
+RUN  apk --no-cache add py-pip \
+  && pip3 install -r /root/extra_requirements.txt --break-system-packages \
+  && rm -f /root/extra_requirements.txt
 
 RUN sed -e 's/ *#.*$//' -e '/^ *$/d' /root/extra_packages.txt | \
     xargs tlmgr install \
-  && rm -f /root/texlive.profile \
-           /root/extra_packages.txt
-
-RUN pip3 --no-cache-dir install -r /root/extra_requirements.txt \
-  && rm -f /root/extra_requirements.txt
-
+    && rm -f /root/extra_packages.txt
 ARG TEMPLATES_DIR=/.pandoc/templates
 
 RUN mkdir -p ${TEMPLATES_DIR} && \
diff --git a/alpine/freeze/pandoc-3.1.13.project.freeze b/alpine/freeze/pandoc-3.1.13.project.freeze
new file mode 100644
index 00000000..571a8c72
--- /dev/null
+++ b/alpine/freeze/pandoc-3.1.13.project.freeze
@@ -0,0 +1,336 @@
+active-repositories: hackage.haskell.org:merge
+constraints: any.Cabal ==3.8.1.0,
+             any.Cabal-syntax ==3.8.1.0,
+             any.Glob ==0.10.2,
+             any.HUnit ==1.6.2.0,
+             any.JuicyPixels ==3.3.8,
+             JuicyPixels -mmap,
+             any.OneTuple ==0.4.1.1,
+             any.Only ==0.1,
+             any.QuickCheck ==2.14.3,
+             QuickCheck -old-random +templatehaskell,
+             any.SHA ==1.6.4.4,
+             SHA -exe,
+             any.StateVar ==1.2.2,
+             any.aeson ==2.2.1.0,
+             aeson +ordered-keymap,
+             any.aeson-pretty ==0.8.10,
+             aeson-pretty +lib-only,
+             any.alex ==3.5.1.0,
+             any.ansi-terminal ==1.1.1,
+             ansi-terminal -example,
+             any.ansi-terminal-types ==1.1,
+             any.appar ==0.1.8,
+             any.array ==0.5.4.0,
+             any.asn1-encoding ==0.9.6,
+             any.asn1-parse ==0.9.5,
+             any.asn1-types ==0.3.4,
+             any.assoc ==1.1,
+             assoc +tagged,
+             any.async ==2.2.5,
+             async -bench,
+             any.attoparsec ==0.14.4,
+             attoparsec -developer,
+             any.auto-update ==0.1.6,
+             any.base ==4.17.2.0,
+             any.base-compat ==0.13.1,
+             any.base-orphans ==0.9.2,
+             any.base-unicode-symbols ==0.2.4.2,
+             base-unicode-symbols +base-4-8 -old-base,
+             any.base16-bytestring ==1.0.2.0,
+             any.base64-bytestring ==1.2.1.0,
+             any.basement ==0.0.16,
+             any.bifunctors ==5.6.2,
+             bifunctors +tagged,
+             any.binary ==0.8.9.1,
+             any.bitvec ==1.1.5.0,
+             bitvec +simd,
+             any.blaze-builder ==0.4.2.3,
+             any.blaze-html ==0.9.2.0,
+             any.blaze-markup ==0.8.3.0,
+             any.boring ==0.2.1,
+             boring +tagged,
+             any.bsb-http-chunked ==0.0.0.4,
+             any.byteorder ==1.0.4,
+             any.bytestring ==0.11.5.2,
+             any.cabal-doctest ==1.0.9,
+             any.call-stack ==0.4.0,
+             any.case-insensitive ==1.2.1.0,
+             any.cassava ==0.5.3.1,
+             any.cborg ==0.2.10.0,
+             cborg +optimize-gmp,
+             any.cereal ==0.5.8.3,
+             cereal -bytestring-builder,
+             any.citeproc ==0.8.1,
+             citeproc -executable -icu,
+             any.colour ==2.3.6,
+             any.commonmark ==0.2.6,
+             any.commonmark-extensions ==0.2.5.4,
+             any.commonmark-pandoc ==0.2.2.1,
+             any.comonad ==5.0.8,
+             comonad +containers +distributive +indexed-traversable,
+             any.conduit ==1.3.5,
+             any.conduit-extra ==1.3.6,
+             any.constraints ==0.14.1,
+             any.containers ==0.6.7,
+             any.contravariant ==1.5.5,
+             contravariant +semigroups +statevar +tagged,
+             any.cookie ==0.4.6,
+             any.crypton ==1.0.0,
+             crypton -check_alignment +integer-gmp -old_toolchain_inliner +support_aesni +support_deepseq +support_pclmuldq +support_rdrand -support_sse +use_target_attributes,
+             any.crypton-connection ==0.3.2,
+             any.crypton-x509 ==1.7.6,
+             any.crypton-x509-store ==1.6.9,
+             any.crypton-x509-system ==1.6.7,
+             any.crypton-x509-validation ==1.6.12,
+             any.data-default ==0.7.1.1,
+             any.data-default-class ==0.1.2.0,
+             any.data-default-instances-containers ==0.0.1,
+             any.data-default-instances-dlist ==0.0.1,
+             any.data-default-instances-old-locale ==0.0.1,
+             any.data-fix ==0.3.2,
+             any.dec ==0.0.5,
+             any.deepseq ==1.4.8.0,
+             any.digest ==0.0.2.1,
+             digest -have_arm64_crc32c -have_builtin_prefetch -have_mm_prefetch -have_sse42 -have_strong_getauxval -have_weak_getauxval +pkg-config,
+             any.directory ==1.3.7.1,
+             any.distributive ==0.6.2.1,
+             distributive +semigroups +tagged,
+             any.djot ==0.1.1.3,
+             any.dlist ==1.0,
+             dlist -werror,
+             any.doclayout ==0.4.0.1,
+             any.doctemplates ==0.11,
+             any.easy-file ==0.2.5,
+             any.emojis ==0.1.3,
+             any.exceptions ==0.10.5,
+             any.fast-logger ==3.2.2,
+             any.file-embed ==0.0.16.0,
+             any.filepath ==1.4.2.2,
+             any.foldable1-classes-compat ==0.1,
+             foldable1-classes-compat +tagged,
+             any.generically ==0.1.1,
+             any.ghc-bignum ==1.3,
+             any.ghc-boot-th ==9.4.7,
+             any.ghc-prim ==0.9.1,
+             any.gitrev ==1.3.1,
+             any.gridtables ==0.1.0.0,
+             any.haddock-library ==1.11.0,
+             any.half ==0.3.1,
+             any.happy ==1.20.1.1,
+             any.hashable ==1.4.4.0,
+             hashable +integer-gmp -random-initial-seed,
+             any.haskell-lexer ==1.1.1,
+             any.hourglass ==0.2.12,
+             any.hsc2hs ==0.68.10,
+             hsc2hs -in-ghc-tree,
+             any.hslua ==2.3.1,
+             any.hslua-aeson ==2.3.1,
+             any.hslua-classes ==2.3.1,
+             any.hslua-cli ==1.4.2,
+             hslua-cli -executable,
+             any.hslua-core ==2.3.2,
+             any.hslua-list ==1.1.1,
+             any.hslua-marshalling ==2.3.1,
+             any.hslua-module-doclayout ==1.1.1,
+             any.hslua-module-path ==1.1.1,
+             any.hslua-module-system ==1.1.1,
+             any.hslua-module-text ==1.1.1,
+             any.hslua-module-version ==1.1.1,
+             any.hslua-module-zip ==1.1.1,
+             any.hslua-objectorientation ==2.3.1,
+             any.hslua-packaging ==2.3.1,
+             any.hslua-repl ==0.1.2,
+             hslua-repl -executable,
+             any.hslua-typing ==0.1.1,
+             any.http-api-data ==0.6,
+             http-api-data -use-text-show,
+             any.http-client ==0.7.17,
+             http-client +network-uri,
+             any.http-client-tls ==0.3.6.3,
+             any.http-date ==0.0.11,
+             any.http-media ==0.8.1.1,
+             any.http-types ==0.12.4,
+             any.http2 ==5.0.1,
+             http2 -devel -h2spec,
+             any.indexed-traversable ==0.1.3,
+             any.indexed-traversable-instances ==0.1.1.2,
+             any.integer-conversion ==0.1.0.1,
+             any.integer-gmp ==1.1,
+             any.integer-logarithms ==1.0.3.1,
+             integer-logarithms -check-bounds +integer-gmp,
+             any.iproute ==1.7.12,
+             any.ipynb ==0.2,
+             any.isocline ==1.0.9,
+             any.jira-wiki-markup ==1.5.1,
+             any.libyaml ==0.1.4,
+             libyaml -no-unicode -system-libyaml,
+             any.libyaml-clib ==0.2.5,
+             any.lpeg ==1.1.0,
+             lpeg +rely-on-shared-lpeg-library,
+             any.lua ==2.3.2,
+             lua +allow-unsafe-gc -apicheck -cross-compile -export-dynamic -lua_32bits +pkg-config +system-lua,
+             any.memory ==0.18.0,
+             memory +support_bytestring +support_deepseq,
+             any.microlens ==0.4.13.1,
+             any.microlens-ghc ==0.4.14.3,
+             any.microlens-mtl ==0.2.0.3,
+             any.microlens-th ==0.4.3.15,
+             any.mime-types ==0.1.2.0,
+             any.mmorph ==1.2.0,
+             any.monad-control ==1.0.3.1,
+             any.mono-traversable ==1.0.17.0,
+             any.mtl ==2.2.2,
+             any.network ==3.1.4.0,
+             network -devel,
+             any.network-byte-order ==0.1.7,
+             any.network-control ==0.0.2,
+             any.network-uri ==2.6.4.2,
+             any.old-locale ==1.0.0.7,
+             any.old-time ==1.1.0.4,
+             any.open-browser ==0.2.1.0,
+             any.optparse-applicative ==0.18.1.0,
+             optparse-applicative +process,
+             any.ordered-containers ==0.2.3,
+             any.os-string ==2.0.2.1,
+             any.pandoc ==3.1.13,
+             pandoc +embed_data_files,
+             pandoc-cli +lua -nightly +server,
+             any.pandoc-crossref ==0.3.17.0,
+             pandoc-crossref -enable_flaky_tests,
+             any.pandoc-lua-engine ==0.2.1.3,
+             any.pandoc-lua-marshal ==0.2.6,
+             any.pandoc-server ==0.1.0.5,
+             any.pandoc-types ==1.23.1,
+             any.parsec ==3.1.16.1,
+             any.pem ==0.2.4,
+             any.pretty ==1.1.3.6,
+             any.pretty-show ==1.10,
+             any.prettyprinter ==1.7.1,
+             prettyprinter -buildreadme +text,
+             any.prettyprinter-ansi-terminal ==1.1.3,
+             any.primitive ==0.9.0.0,
+             any.process ==1.6.17.0,
+             any.psqueues ==0.2.8.0,
+             any.random ==1.2.1.2,
+             any.recv ==0.1.0,
+             any.regex-base ==0.94.0.2,
+             any.regex-tdfa ==1.3.2.2,
+             regex-tdfa +doctest -force-o2,
+             any.resourcet ==1.3.0,
+             any.rts ==1.0.2,
+             any.safe ==0.3.21,
+             any.safe-exceptions ==0.1.7.4,
+             any.scientific ==0.3.7.0,
+             scientific -bytestring-builder -integer-simple,
+             any.semialign ==1.3,
+             semialign +semigroupoids,
+             any.semigroupoids ==6.0.0.1,
+             semigroupoids +comonad +containers +contravariant +distributive +tagged +unordered-containers,
+             any.serialise ==0.2.6.1,
+             serialise +newtime15,
+             any.servant ==0.20.1,
+             any.servant-server ==0.20,
+             any.simple-sendfile ==0.2.32,
+             simple-sendfile +allow-bsd -fallback,
+             any.singleton-bool ==0.1.7,
+             any.skylighting ==0.14.1.1,
+             skylighting -executable,
+             any.skylighting-core ==0.14.1.1,
+             skylighting-core -executable,
+             any.skylighting-format-ansi ==0.1,
+             any.skylighting-format-blaze-html ==0.1.1.2,
+             any.skylighting-format-context ==0.1.0.2,
+             any.skylighting-format-latex ==0.1,
+             any.socks ==0.6.1,
+             any.some ==1.0.6,
+             some +newtype-unsafe,
+             any.sop-core ==0.5.0.2,
+             any.split ==0.2.5,
+             any.splitmix ==0.1.0.5,
+             splitmix -optimised-mixer,
+             any.stm ==2.5.1.0,
+             any.streaming-commons ==0.2.2.6,
+             streaming-commons -use-bytestring-builder,
+             any.strict ==0.5,
+             any.string-conversions ==0.4.0.1,
+             any.syb ==0.7.2.4,
+             any.tagged ==0.8.8,
+             tagged +deepseq +transformers,
+             any.tagsoup ==0.14.8,
+             any.template-haskell ==2.19.0.0,
+             any.temporary ==1.3,
+             any.texmath ==0.12.8.8,
+             texmath -executable -server,
+             any.text ==2.0.2,
+             any.text-conversions ==0.3.1.1,
+             any.text-iso8601 ==0.1,
+             any.text-short ==0.1.5,
+             text-short -asserts,
+             any.th-abstraction ==0.6.0.0,
+             any.th-compat ==0.1.5,
+             any.th-lift ==0.8.4,
+             any.th-lift-instances ==0.1.20,
+             any.these ==1.2,
+             any.time ==1.12.2,
+             any.time-compat ==1.9.6.1,
+             time-compat -old-locale,
+             any.time-manager ==0.0.1,
+             any.tls ==2.0.5,
+             tls -devel,
+             any.toml-parser ==2.0.0.0,
+             any.transformers ==0.5.6.2,
+             any.transformers-base ==0.4.6,
+             transformers-base +orphaninstances,
+             any.transformers-compat ==0.7.2,
+             transformers-compat -five +five-three -four +generic-deriving +mtl -three -two,
+             any.typed-process ==0.2.11.1,
+             any.typst ==0.5.0.3,
+             typst -executable,
+             any.typst-symbols ==0.1.6,
+             any.unicode-collation ==0.1.3.6,
+             unicode-collation -doctests -executable,
+             any.unicode-data ==0.4.0.1,
+             unicode-data -ucd2haskell,
+             any.unicode-transforms ==0.4.0.1,
+             unicode-transforms -bench-show -dev -has-icu -has-llvm -use-gauge,
+             any.uniplate ==1.6.13,
+             any.unix ==2.7.3,
+             any.unix-compat ==0.7.1,
+             unix-compat -old-time,
+             any.unix-time ==0.4.12,
+             any.unliftio ==0.2.25.0,
+             any.unliftio-core ==0.2.1.0,
+             any.unordered-containers ==0.2.20,
+             unordered-containers -debug,
+             any.utf8-string ==1.0.2,
+             any.utility-ht ==0.0.17.1,
+             any.uuid-types ==1.0.5.1,
+             any.vault ==0.3.1.5,
+             vault +useghc,
+             any.vector ==0.13.1.0,
+             vector +boundschecks -internalchecks -unsafechecks -wall,
+             any.vector-algorithms ==0.9.0.1,
+             vector-algorithms +bench +boundschecks -internalchecks -llvm +properties -unsafechecks,
+             any.vector-stream ==0.1.0.1,
+             any.wai ==3.2.4,
+             any.wai-app-static ==3.1.9,
+             wai-app-static +crypton -print,
+             any.wai-cors ==0.2.7,
+             any.wai-extra ==3.1.14,
+             wai-extra -build-example,
+             any.wai-logger ==2.4.0,
+             any.warp ==3.3.31,
+             warp +allow-sendfilefd -network-bytestring -warp-debug +x509,
+             any.witherable ==0.4.2,
+             any.word8 ==0.1.3,
+             any.xml ==1.3.14,
+             any.xml-conduit ==1.9.1.3,
+             any.xml-types ==0.3.8,
+             any.yaml ==0.11.11.2,
+             yaml +no-examples +no-exe,
+             any.zip-archive ==0.4.3.2,
+             zip-archive -executable,
+             any.zlib ==0.7.1.0,
+             zlib -bundled-c-zlib +non-blocking-ffi +pkg-config
+index-state: hackage.haskell.org 2024-05-03T13:19:35Z
diff --git a/alpine/freeze/pandoc-main.project.freeze b/alpine/freeze/pandoc-main.project.freeze
index 4efea1de..d26a1ac5 100644
--- a/alpine/freeze/pandoc-main.project.freeze
+++ b/alpine/freeze/pandoc-main.project.freeze
@@ -1,5 +1,5 @@
 constraints: lua  +system-lua +pkg-config +hardcode-reg-keys -export-dynamic,
-             lpeg  +rely-on-shared-lpeg-library,
+             lpeg  -rely-on-shared-lpeg-library,
              aeson-pretty  +lib-only,
              pandoc  +embed_data_files,
              pandoc-cli  +lua +nightly +server
diff --git a/build.sh b/build.sh
index 369cc12e..d393ea69 100755
--- a/build.sh
+++ b/build.sh
@@ -214,6 +214,7 @@ case "$action" in
                --build-arg extra_packages="${extra_packages}"\
                --build-arg base_image_version="${base_image_version}" \
                --build-arg texlive_version="${texlive_version}" \
+               --build-arg texlive_mirror_url="${TEXLIVE_MIRROR_URL}" \
                --build-arg lua_version="${lua_version}" \
                --target "${target}"\
                -f "${directory}/${stack}/Dockerfile"\
diff --git a/common/extra/packages.txt b/common/extra/packages.txt
index 276ee4e0..f0aa22df 100644
--- a/common/extra/packages.txt
+++ b/common/extra/packages.txt
@@ -21,6 +21,7 @@ background
 bidi
 catchfile
 collectbox
+cm-super
 csquotes
 everypage
 filehook
diff --git a/common/extra/requirements.txt b/common/extra/requirements.txt
index 3cc361ed..e1e72ae6 100644
--- a/common/extra/requirements.txt
+++ b/common/extra/requirements.txt
@@ -5,4 +5,4 @@
 # because minor versions (e.g. `1.3.6`) _should_ not break things
 #
 
-pandoc-latex-environment==1.1
+pandoc-latex-environment==1.1.*
diff --git a/common/latex/install-texlive.sh b/common/latex/install-texlive.sh
index 9c937956..45acd819 100755
--- a/common/latex/install-texlive.sh
+++ b/common/latex/install-texlive.sh
@@ -2,31 +2,88 @@
 
 # NOTE TO MAINTAINERS: this must be updated each time a new texlive is
 # released!
-default_version=2023
+default_version=2024
 tlversion=${1:-"$default_version"}
 installer_archive=install-tl-unx.tar.gz
 
-# Do normal install for the default version.
-if [ "$tlversion" = "$default_version" ]; then
+usage ()
+{
+    printf 'Install TeXLive\n'
+    printf 'Usage: %s [OPTIONS]\n\n' "$0"
+    printf 'Options:\n'
+    printf '  -t: TeXLive version (default %s)\n' "$default_version"
+    printf '  -m: mirror URL\n'
+}
+
+if ! args=$(getopt 't:m:' "$@"); then
+    usage && exit 1
+fi
+# The variable is intentionally left unquoted.
+# shellcheck disable=SC2086
+set -- $args
+
+tlversion=
+mirror_url=
+
+while true; do
+    case "$1" in
+        (-t)
+            tlversion="${2}"
+            shift 2
+            ;;
+        (-m)
+            mirror_url="${2}"
+            shift 2
+            ;;
+        (--)
+            shift
+            break
+            ;;
+        (*)
+            printf 'Unknown option: %s\n' "$1"
+            usage
+            exit 1
+            ;;
+    esac
+done
+
+[ -n "$tlversion" ] || tlversion="$default_version"
+
+if [ -z "$mirror_url" ] && [ "$tlversion" != "$default_version" ]; then
+    # Default mirror for historic releases
+    mirror_url="ftp://tug.org/historic/"
+fi
+
+if [ -z "$mirror_url" ]; then
     # Get the mirror URL from the redirect. Otherwise, if we were to
     # always use the mirror URL, we'd run into problems whenever we get
     # installer and signatures from different mirrors that are not 100%
     # in sync.
-    installer_url=$(wget --quiet --output-document=/dev/null \
-                         --server-response \
-                         http://mirror.ctan.org/systems/texlive/tlnet/ \
-                         2>&1 | \
-                        sed -ne 's/.*Location: \(.*\)$/\1/p')
+    mirror_url=$(wget -4 --quiet --output-document=/dev/null \
+                      --server-response \
+                      http://mirror.ctan.org/ \
+                      2>&1 | \
+                      sed -ne 's/.*Location: \(.*\)$/\1/p' | head -n 1)
+fi
+
+# Trim trailing slash(es)
+mirror_url=$(echo "$mirror_url" | sed -e 's/\/*$//')
+
+if [ "$tlversion" = "$default_version" ]; then
+    installer_url="$mirror_url/systems/texlive/tlnet/"
     repository=
 else
-    installer_url="\
-ftp://tug.org/historic/systems/texlive/$tlversion/tlnet-final"
-    repository="\
-ftp://tug.org/historic/systems/texlive/$tlversion/tlnet-final"
+    installer_url="$mirror_url/systems/texlive/$tlversion/tlnet-final/"
+    repository=$installer_url
 fi
 
-# Download the install-tl perl script.
-wget --no-verbose \
+# Log the installer and repository url
+printf 'installer URL: %s\n' "${installer_url}"
+printf 'repository: %s\n' "${repository}"
+
+# Download the install-tl perl script. The archive integrity and signature is
+# verified later, so it's ok if we use an insecure connection.
+wget -4 --no-verbose --no-check-certificate \
      "$installer_url/$installer_archive" \
      "$installer_url/$installer_archive".sha512 \
      "$installer_url/$installer_archive".sha512.asc \
diff --git a/common/latex/packages.txt b/common/latex/packages.txt
index cef5a655..fbc1b824 100644
--- a/common/latex/packages.txt
+++ b/common/latex/packages.txt
@@ -54,6 +54,7 @@ embedfile
 fontspec
 hyperxmp
 ifmtarg
+latexmk
 luacode
 lualatex-math
 luatexbase
diff --git a/common/pandoc-freeze.sh b/common/pandoc-freeze.sh
index 5c172719..71b8ddcd 100644
--- a/common/pandoc-freeze.sh
+++ b/common/pandoc-freeze.sh
@@ -88,23 +88,9 @@ aeson_pretty_constraints=" +lib-only"
 pandoc_constraints=" +embed_data_files"
 pandoc_cli_constraints=" +lua -nightly +server"
 
-uses_hslua_2 ()
-{
-    major=$(printf "%s" "$pandoc_commit" | \
-                awk -F. '{ printf("%03d%03d\n", $1,$2); }')
-    test "${major}" -ge "002015" || [ "$pandoc_commit" = "main" ]
-    return $?
-}
-
-if uses_hslua_2; then
-    lua_package=lua
-else
-    lua_package=hslua
-fi
-
 print_constraints_only ()
 {
-    printf "constraints: %s %s,\n" "${lua_package}" "${lua_constraints}"
+    printf "constraints: %s %s,\n" "lua" "${lua_constraints}"
     printf "             lpeg %s,\n" "${lpeg_constraints}"
     printf '             aeson-pretty %s,\n' "${aeson_pretty_constraints}"
     printf "             pandoc %s\n" "${pandoc_constraints}"
@@ -120,7 +106,13 @@ if [ "$pandoc_commit" = "main" ]; then
     exit 0
 fi
 
-pandoc_cli_version=0.1
+pandoc_cli_version=$pandoc_commit
+minor=$(printf "%s" "$pandoc_commit" | \
+            awk -F. '{ printf("%03d%03d%03d\n", $1,$2,$3); }')
+if test "${minor}" -le "003001010"; then
+    # pandoc versions before 3.1.11 used pandoc-cli-0.1
+   pandoc_cli_version=0.1
+fi
 
 # Download latest cabal database
 cabal update
@@ -147,7 +139,7 @@ cabal v2-freeze \
       --constraint="pandoc-cli ${pandoc_cli_constraints}" \
       --constraint="lpeg ${lpeg_constraints}" \
       --constraint="aeson-pretty ${aeson_pretty_constraints}" \
-      --constraint="${lua_package} ${lua_constraints}" \
+      --constraint="lua ${lua_constraints}" \
       --allow-newer='pandoc'
 
 printf "Copying freeze file to %s\n" "${outfile}"
diff --git a/docs/sections/run.md b/docs/sections/run.md
index d8cfc017..ce7ee128 100644
--- a/docs/sections/run.md
+++ b/docs/sections/run.md
@@ -8,11 +8,11 @@ readability):
 docker run --rm \
        --volume "$(pwd):/data" \
        --user $(id -u):$(id -g) \
-       pandoc/latex README.md -o outfile.pdf
+       pandoc/latex README.md -o outfile.epub
 ```
 
 This will convert the file `README.md` in the current working
-directory into `outfile.pdf`. Note that Docker options go *before*
+directory into `outfile.epub`. Note that Docker options go *before*
 the image name, here `pandoc/latex`, while pandoc options come
 *after* it.
 
diff --git a/previous-versions.md b/previous-versions.md
index 7b913758..150f6d9d 100644
--- a/previous-versions.md
+++ b/previous-versions.md
@@ -3,6 +3,8 @@
 | 3.1      | 3.1.0.0  3.1.0                | 3.16.4 | jammy  |    2022 | 5.4 |
 | 2.19.1   | 2.19.1.0 2.19.1               | 3.16.1 | jammy  |    2022 | 5.3 |
 | 2.19     | 2.19.0.0 2.19.0               | 3.16.1 | jammy  |    2022 | 5.3 |
+| 2.18     | 2.18.0.0 2.18.0 2.18          | 3.14.8 | focal  |    2021 | 5.3 |
+| 2.17.1.1 | 2.17.1.1 2.17.1 2.17          | 3.14.8 | focal  |    2021 | 5.3 |
 | 2.17.1   | 2.17.1.0                      | 3.14.3 | focal  |    2021 | 5.3 |
 | 2.17.0.1 | 2.17.0.1 2.17.0               | 3.14.3 | focal  |    2021 | 5.3 |
 | 2.17     | 2.17.0.0                      | 3.14.3 | focal  |    2021 | 5.3 |
diff --git a/static/freeze/pandoc-3.1.13.project.freeze b/static/freeze/pandoc-3.1.13.project.freeze
new file mode 100644
index 00000000..aefc13de
--- /dev/null
+++ b/static/freeze/pandoc-3.1.13.project.freeze
@@ -0,0 +1,336 @@
+active-repositories: hackage.haskell.org:merge
+constraints: any.Cabal ==3.8.1.0,
+             any.Cabal-syntax ==3.8.1.0,
+             any.Glob ==0.10.2,
+             any.HUnit ==1.6.2.0,
+             any.JuicyPixels ==3.3.8,
+             JuicyPixels -mmap,
+             any.OneTuple ==0.4.1.1,
+             any.Only ==0.1,
+             any.QuickCheck ==2.14.3,
+             QuickCheck -old-random +templatehaskell,
+             any.SHA ==1.6.4.4,
+             SHA -exe,
+             any.StateVar ==1.2.2,
+             any.aeson ==2.2.1.0,
+             aeson +ordered-keymap,
+             any.aeson-pretty ==0.8.10,
+             aeson-pretty +lib-only,
+             any.alex ==3.5.1.0,
+             any.ansi-terminal ==1.1.1,
+             ansi-terminal -example,
+             any.ansi-terminal-types ==1.1,
+             any.appar ==0.1.8,
+             any.array ==0.5.4.0,
+             any.asn1-encoding ==0.9.6,
+             any.asn1-parse ==0.9.5,
+             any.asn1-types ==0.3.4,
+             any.assoc ==1.1,
+             assoc +tagged,
+             any.async ==2.2.5,
+             async -bench,
+             any.attoparsec ==0.14.4,
+             attoparsec -developer,
+             any.auto-update ==0.1.6,
+             any.base ==4.17.2.0,
+             any.base-compat ==0.13.1,
+             any.base-orphans ==0.9.2,
+             any.base-unicode-symbols ==0.2.4.2,
+             base-unicode-symbols +base-4-8 -old-base,
+             any.base16-bytestring ==1.0.2.0,
+             any.base64-bytestring ==1.2.1.0,
+             any.basement ==0.0.16,
+             any.bifunctors ==5.6.2,
+             bifunctors +tagged,
+             any.binary ==0.8.9.1,
+             any.bitvec ==1.1.5.0,
+             bitvec +simd,
+             any.blaze-builder ==0.4.2.3,
+             any.blaze-html ==0.9.2.0,
+             any.blaze-markup ==0.8.3.0,
+             any.boring ==0.2.1,
+             boring +tagged,
+             any.bsb-http-chunked ==0.0.0.4,
+             any.byteorder ==1.0.4,
+             any.bytestring ==0.11.5.2,
+             any.cabal-doctest ==1.0.9,
+             any.call-stack ==0.4.0,
+             any.case-insensitive ==1.2.1.0,
+             any.cassava ==0.5.3.1,
+             any.cborg ==0.2.10.0,
+             cborg +optimize-gmp,
+             any.cereal ==0.5.8.3,
+             cereal -bytestring-builder,
+             any.citeproc ==0.8.1,
+             citeproc -executable -icu,
+             any.colour ==2.3.6,
+             any.commonmark ==0.2.6,
+             any.commonmark-extensions ==0.2.5.4,
+             any.commonmark-pandoc ==0.2.2.1,
+             any.comonad ==5.0.8,
+             comonad +containers +distributive +indexed-traversable,
+             any.conduit ==1.3.5,
+             any.conduit-extra ==1.3.6,
+             any.constraints ==0.14.1,
+             any.containers ==0.6.7,
+             any.contravariant ==1.5.5,
+             contravariant +semigroups +statevar +tagged,
+             any.cookie ==0.4.6,
+             any.crypton ==1.0.0,
+             crypton -check_alignment +integer-gmp -old_toolchain_inliner +support_aesni +support_deepseq +support_pclmuldq +support_rdrand -support_sse +use_target_attributes,
+             any.crypton-connection ==0.3.2,
+             any.crypton-x509 ==1.7.6,
+             any.crypton-x509-store ==1.6.9,
+             any.crypton-x509-system ==1.6.7,
+             any.crypton-x509-validation ==1.6.12,
+             any.data-default ==0.7.1.1,
+             any.data-default-class ==0.1.2.0,
+             any.data-default-instances-containers ==0.0.1,
+             any.data-default-instances-dlist ==0.0.1,
+             any.data-default-instances-old-locale ==0.0.1,
+             any.data-fix ==0.3.2,
+             any.dec ==0.0.5,
+             any.deepseq ==1.4.8.0,
+             any.digest ==0.0.2.1,
+             digest -have_arm64_crc32c -have_builtin_prefetch -have_mm_prefetch -have_sse42 -have_strong_getauxval -have_weak_getauxval +pkg-config,
+             any.directory ==1.3.7.1,
+             any.distributive ==0.6.2.1,
+             distributive +semigroups +tagged,
+             any.djot ==0.1.1.3,
+             any.dlist ==1.0,
+             dlist -werror,
+             any.doclayout ==0.4.0.1,
+             any.doctemplates ==0.11,
+             any.easy-file ==0.2.5,
+             any.emojis ==0.1.3,
+             any.exceptions ==0.10.5,
+             any.fast-logger ==3.2.2,
+             any.file-embed ==0.0.16.0,
+             any.filepath ==1.4.2.2,
+             any.foldable1-classes-compat ==0.1,
+             foldable1-classes-compat +tagged,
+             any.generically ==0.1.1,
+             any.ghc-bignum ==1.3,
+             any.ghc-boot-th ==9.4.7,
+             any.ghc-prim ==0.9.1,
+             any.gitrev ==1.3.1,
+             any.gridtables ==0.1.0.0,
+             any.haddock-library ==1.11.0,
+             any.half ==0.3.1,
+             any.happy ==1.20.1.1,
+             any.hashable ==1.4.4.0,
+             hashable +integer-gmp -random-initial-seed,
+             any.haskell-lexer ==1.1.1,
+             any.hourglass ==0.2.12,
+             any.hsc2hs ==0.68.10,
+             hsc2hs -in-ghc-tree,
+             any.hslua ==2.3.1,
+             any.hslua-aeson ==2.3.1,
+             any.hslua-classes ==2.3.1,
+             any.hslua-cli ==1.4.2,
+             hslua-cli -executable,
+             any.hslua-core ==2.3.2,
+             any.hslua-list ==1.1.1,
+             any.hslua-marshalling ==2.3.1,
+             any.hslua-module-doclayout ==1.1.1,
+             any.hslua-module-path ==1.1.1,
+             any.hslua-module-system ==1.1.1,
+             any.hslua-module-text ==1.1.1,
+             any.hslua-module-version ==1.1.1,
+             any.hslua-module-zip ==1.1.1,
+             any.hslua-objectorientation ==2.3.1,
+             any.hslua-packaging ==2.3.1,
+             any.hslua-repl ==0.1.2,
+             hslua-repl -executable,
+             any.hslua-typing ==0.1.1,
+             any.http-api-data ==0.6,
+             http-api-data -use-text-show,
+             any.http-client ==0.7.17,
+             http-client +network-uri,
+             any.http-client-tls ==0.3.6.3,
+             any.http-date ==0.0.11,
+             any.http-media ==0.8.1.1,
+             any.http-types ==0.12.4,
+             any.http2 ==5.0.1,
+             http2 -devel -h2spec,
+             any.indexed-traversable ==0.1.3,
+             any.indexed-traversable-instances ==0.1.1.2,
+             any.integer-conversion ==0.1.0.1,
+             any.integer-gmp ==1.1,
+             any.integer-logarithms ==1.0.3.1,
+             integer-logarithms -check-bounds +integer-gmp,
+             any.iproute ==1.7.12,
+             any.ipynb ==0.2,
+             any.isocline ==1.0.9,
+             any.jira-wiki-markup ==1.5.1,
+             any.libyaml ==0.1.4,
+             libyaml -no-unicode -system-libyaml,
+             any.libyaml-clib ==0.2.5,
+             any.lpeg ==1.1.0,
+             lpeg -rely-on-shared-lpeg-library,
+             any.lua ==2.3.2,
+             lua +allow-unsafe-gc -apicheck -cross-compile -export-dynamic -lua_32bits -pkg-config -system-lua,
+             any.memory ==0.18.0,
+             memory +support_bytestring +support_deepseq,
+             any.microlens ==0.4.13.1,
+             any.microlens-ghc ==0.4.14.3,
+             any.microlens-mtl ==0.2.0.3,
+             any.microlens-th ==0.4.3.15,
+             any.mime-types ==0.1.2.0,
+             any.mmorph ==1.2.0,
+             any.monad-control ==1.0.3.1,
+             any.mono-traversable ==1.0.17.0,
+             any.mtl ==2.2.2,
+             any.network ==3.1.4.0,
+             network -devel,
+             any.network-byte-order ==0.1.7,
+             any.network-control ==0.0.2,
+             any.network-uri ==2.6.4.2,
+             any.old-locale ==1.0.0.7,
+             any.old-time ==1.1.0.4,
+             any.open-browser ==0.2.1.0,
+             any.optparse-applicative ==0.18.1.0,
+             optparse-applicative +process,
+             any.ordered-containers ==0.2.3,
+             any.os-string ==2.0.2.1,
+             any.pandoc ==3.1.13,
+             pandoc +embed_data_files,
+             pandoc-cli +lua -nightly +server,
+             any.pandoc-crossref ==0.3.17.0,
+             pandoc-crossref -enable_flaky_tests,
+             any.pandoc-lua-engine ==0.2.1.3,
+             any.pandoc-lua-marshal ==0.2.6,
+             any.pandoc-server ==0.1.0.5,
+             any.pandoc-types ==1.23.1,
+             any.parsec ==3.1.16.1,
+             any.pem ==0.2.4,
+             any.pretty ==1.1.3.6,
+             any.pretty-show ==1.10,
+             any.prettyprinter ==1.7.1,
+             prettyprinter -buildreadme +text,
+             any.prettyprinter-ansi-terminal ==1.1.3,
+             any.primitive ==0.9.0.0,
+             any.process ==1.6.17.0,
+             any.psqueues ==0.2.8.0,
+             any.random ==1.2.1.2,
+             any.recv ==0.1.0,
+             any.regex-base ==0.94.0.2,
+             any.regex-tdfa ==1.3.2.2,
+             regex-tdfa +doctest -force-o2,
+             any.resourcet ==1.3.0,
+             any.rts ==1.0.2,
+             any.safe ==0.3.21,
+             any.safe-exceptions ==0.1.7.4,
+             any.scientific ==0.3.7.0,
+             scientific -bytestring-builder -integer-simple,
+             any.semialign ==1.3,
+             semialign +semigroupoids,
+             any.semigroupoids ==6.0.0.1,
+             semigroupoids +comonad +containers +contravariant +distributive +tagged +unordered-containers,
+             any.serialise ==0.2.6.1,
+             serialise +newtime15,
+             any.servant ==0.20.1,
+             any.servant-server ==0.20,
+             any.simple-sendfile ==0.2.32,
+             simple-sendfile +allow-bsd -fallback,
+             any.singleton-bool ==0.1.7,
+             any.skylighting ==0.14.1.1,
+             skylighting -executable,
+             any.skylighting-core ==0.14.1.1,
+             skylighting-core -executable,
+             any.skylighting-format-ansi ==0.1,
+             any.skylighting-format-blaze-html ==0.1.1.2,
+             any.skylighting-format-context ==0.1.0.2,
+             any.skylighting-format-latex ==0.1,
+             any.socks ==0.6.1,
+             any.some ==1.0.6,
+             some +newtype-unsafe,
+             any.sop-core ==0.5.0.2,
+             any.split ==0.2.5,
+             any.splitmix ==0.1.0.5,
+             splitmix -optimised-mixer,
+             any.stm ==2.5.1.0,
+             any.streaming-commons ==0.2.2.6,
+             streaming-commons -use-bytestring-builder,
+             any.strict ==0.5,
+             any.string-conversions ==0.4.0.1,
+             any.syb ==0.7.2.4,
+             any.tagged ==0.8.8,
+             tagged +deepseq +transformers,
+             any.tagsoup ==0.14.8,
+             any.template-haskell ==2.19.0.0,
+             any.temporary ==1.3,
+             any.texmath ==0.12.8.8,
+             texmath -executable -server,
+             any.text ==2.0.2,
+             any.text-conversions ==0.3.1.1,
+             any.text-iso8601 ==0.1,
+             any.text-short ==0.1.5,
+             text-short -asserts,
+             any.th-abstraction ==0.6.0.0,
+             any.th-compat ==0.1.5,
+             any.th-lift ==0.8.4,
+             any.th-lift-instances ==0.1.20,
+             any.these ==1.2,
+             any.time ==1.12.2,
+             any.time-compat ==1.9.6.1,
+             time-compat -old-locale,
+             any.time-manager ==0.0.1,
+             any.tls ==2.0.5,
+             tls -devel,
+             any.toml-parser ==2.0.0.0,
+             any.transformers ==0.5.6.2,
+             any.transformers-base ==0.4.6,
+             transformers-base +orphaninstances,
+             any.transformers-compat ==0.7.2,
+             transformers-compat -five +five-three -four +generic-deriving +mtl -three -two,
+             any.typed-process ==0.2.11.1,
+             any.typst ==0.5.0.3,
+             typst -executable,
+             any.typst-symbols ==0.1.6,
+             any.unicode-collation ==0.1.3.6,
+             unicode-collation -doctests -executable,
+             any.unicode-data ==0.4.0.1,
+             unicode-data -ucd2haskell,
+             any.unicode-transforms ==0.4.0.1,
+             unicode-transforms -bench-show -dev -has-icu -has-llvm -use-gauge,
+             any.uniplate ==1.6.13,
+             any.unix ==2.7.3,
+             any.unix-compat ==0.7.1,
+             unix-compat -old-time,
+             any.unix-time ==0.4.12,
+             any.unliftio ==0.2.25.0,
+             any.unliftio-core ==0.2.1.0,
+             any.unordered-containers ==0.2.20,
+             unordered-containers -debug,
+             any.utf8-string ==1.0.2,
+             any.utility-ht ==0.0.17.1,
+             any.uuid-types ==1.0.5.1,
+             any.vault ==0.3.1.5,
+             vault +useghc,
+             any.vector ==0.13.1.0,
+             vector +boundschecks -internalchecks -unsafechecks -wall,
+             any.vector-algorithms ==0.9.0.1,
+             vector-algorithms +bench +boundschecks -internalchecks -llvm +properties -unsafechecks,
+             any.vector-stream ==0.1.0.1,
+             any.wai ==3.2.4,
+             any.wai-app-static ==3.1.9,
+             wai-app-static +crypton -print,
+             any.wai-cors ==0.2.7,
+             any.wai-extra ==3.1.14,
+             wai-extra -build-example,
+             any.wai-logger ==2.4.0,
+             any.warp ==3.3.31,
+             warp +allow-sendfilefd -network-bytestring -warp-debug +x509,
+             any.witherable ==0.4.2,
+             any.word8 ==0.1.3,
+             any.xml ==1.3.14,
+             any.xml-conduit ==1.9.1.3,
+             any.xml-types ==0.3.8,
+             any.yaml ==0.11.11.2,
+             yaml +no-examples +no-exe,
+             any.zip-archive ==0.4.3.2,
+             zip-archive -executable,
+             any.zlib ==0.7.1.0,
+             zlib -bundled-c-zlib +non-blocking-ffi +pkg-config
+index-state: hackage.haskell.org 2024-05-03T13:19:35Z
diff --git a/test/Makefile b/test/Makefile
index 0f8d2d94..13cff022 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -1,7 +1,8 @@
-# Two primary targets are defined by this Makefile:
+# Three primary targets are defined by this Makefile:
 #
 # 1. test-minimal: test a minimal base image
 # 2. test-latex: test a latex image
+# 3. test-extra: test an extra image
 #
 # The IMAGE variable is required to be defined in order to `docker run` the
 # various tests.  The parent Makefile test targets define this, or alternatively
@@ -81,8 +82,7 @@ test-crossref-filter: $(test_files_path)/crossref-test.md \
 #
 LATEX_CMD = docker run --rm \
 	-v $(test_files_path):/data \
-	$(IMAGE) \
-	--fail-if-warnings
+	$(IMAGE)
 
 # Generate list of targets to test all highlighting options available in pandoc.
 # See: https://pandoc.org/MANUAL.html#option--highlight-style
@@ -111,17 +111,18 @@ test-latex: output/testsuite.pdf output/french.pdf output/german.pdf \
 output/testsuite.pdf: testsuite.native
 	$(LATEX_CMD) $< \
 	    --output=$@ \
-	    --pdf-engine=xelatex
+	    --pdf-engine=latexmk
 
 output/french.pdf: french.md
 	$(LATEX_CMD) $< \
 	    --output=$@ \
+	    --variable=csquotes \
 	    --pdf-engine=xelatex
 
 output/german.pdf: german.md
 	$(LATEX_CMD) $< \
 	    --output=$@ \
-	    --pdf-engine=xelatex
+	    --pdf-engine=lualatex
 
 output/lorem-geometry.pdf: lorem.md geometry.yaml
 	$(LATEX_CMD) $< \
@@ -188,7 +189,7 @@ EXTRA_CMD = docker run --rm \
 	--fail-if-warnings
 
 .PHONY: test-extra
-test-extra: output/eisvogel.pdf output/beamertheme-metropolis.pdf
+test-extra: output/eisvogel.pdf output/eisvogel_with_environment.pdf output/beamertheme-metropolis.pdf
 
 output/eisvogel.pdf: eisvogel.md
 	$(EXTRA_CMD) $< \
@@ -196,6 +197,13 @@ output/eisvogel.pdf: eisvogel.md
 	    --template=eisvogel \
 	    --pdf-engine=xelatex
 
+output/eisvogel_with_environment.pdf: eisvogel.md
+	$(EXTRA_CMD) $< \
+	    --output=$@ \
+	    --template=eisvogel \
+	    --pdf-engine=xelatex \
+	    --filter=pandoc-latex-environment
+
 output/beamertheme-metropolis.pdf: beamertheme-metropolis.md
 	$(EXTRA_CMD) $< \
 	    --output=$@ \
diff --git a/test/eisvogel.md b/test/eisvogel.md
index 0ca5660e..edb94931 100644
--- a/test/eisvogel.md
+++ b/test/eisvogel.md
@@ -135,3 +135,10 @@ quis lectus elementum fermentum.*
 
 [`pandoc-latex-environments`]: https://github.com/chdemko/pandoc-latex-environment/
 [`awesomebox`]: https://ctan.org/pkg/awesomebox
+
+
+## bug 216 : missing font error
+
+```
+Some block of `code` with `backticks`
+```
diff --git a/ubuntu/Dockerfile b/ubuntu/Dockerfile
index bf79c4a6..b527b45a 100644
--- a/ubuntu/Dockerfile
+++ b/ubuntu/Dockerfile
@@ -1,38 +1,26 @@
 # Base ##################################################################
-ARG base_image_version=jammy
+ARG base_image_version=noble
 FROM ubuntu:$base_image_version AS ubuntu-builder-base
 WORKDIR /app
 
 ## Not sure why we have to repeat this, but apparently the arg is no
 ## longer set after FROM.
-ARG base_image_version=jammy
+ARG base_image_version=noble
 ARG lua_version=5.4
 ENV DEBIAN_FRONTEND noninteractive
 RUN apt-get -q --no-allow-insecure-repositories update \
-  && if [ $base_image_version = "focal" ]; then \
-         apt-get install --assume-yes --no-install-recommends \
-                 software-properties-common \
-         && add-apt-repository ppa:hvr/ghc \
-         && apt-get install --assume-yes --no-install-recommends \
-                    ghc-8.8.4=\* \
-                    cabal-install-3.0=\* \
-         && ln -s /opt/ghc/bin/ghc /usr/bin/ghc \
-         && ln -s /opt/cabal/bin/cabal /usr/bin/cabal; \
-     else \
-         apt-get install --assume-yes --no-install-recommends \
-                 ghc=* \
-                 cabal-install=*; \
-     fi \
   && apt-get install --assume-yes --no-install-recommends \
        build-essential=* \
        ca-certificates=* \
+       cabal-install=* \
        curl=* \
        fakeroot=* \
        git \
+       ghc=* \
        libgmp-dev=2:6.* \
        liblua$lua_version-dev=* \
        pkg-config=* \
-       zlib1g-dev=1:1.2.11.* \
+       zlib1g-dev=* \
   && rm -rf /var/lib/apt/lists/*
 
 COPY cabal.root.config /root/.cabal/config
@@ -158,7 +146,12 @@ COPY common/latex/packages.txt /root/packages.txt
 # TeXLive version to install (leave empty to use the latest version).
 ARG texlive_version=
 
-RUN /root/install-texlive.sh $texlive_version \
+# TeXLive mirror URL (leave empty to use the default mirror).
+ARG texlive_mirror_url=
+
+RUN ( [ -z "$texlive_version"    ] || printf '-t\n%s\n"' "$texlive_version" \
+    ; [ -z "$texlive_mirror_url" ] || printf '-m\n%s\n' "$texlive_mirror_url" \
+    ) | xargs /root/install-texlive.sh \
   && sed -e 's/ *#.*$//' -e '/^ *$/d' /root/packages.txt | \
      xargs tlmgr install \
   && rm -f /root/texlive.profile \
@@ -172,21 +165,20 @@ WORKDIR /data
 # extra ##############################################################
 FROM ubuntu-latex as ubuntu-extra
 
-COPY common/latex/texlive.profile /root/texlive.profile
 COPY common/extra/packages.txt /root/extra_packages.txt
 COPY common/extra/requirements.txt /root/extra_requirements.txt
 
+# The option `--break-system-packages` sounds bad but this is not
+# really a problem here because we are not using Python debian packages
+# anyway.
 RUN apt-get -q --no-allow-insecure-repositories update \
-  && apt-get install --assume-yes --no-install-recommends \
-        python3-pip
+  && apt-get install --assume-yes --no-install-recommends python3-pip \
+  && pip3 install -r /root/extra_requirements.txt --break-system-packages \
+  && rm -f /root/extra_requirements.txt
 
 RUN sed -e 's/ *#.*$//' -e '/^ *$/d' /root/extra_packages.txt | \
     xargs tlmgr install \
-  && rm -f /root/texlive.profile \
-           /root/extra_packages.txt
-
-RUN pip3 --no-cache-dir install -r /root/extra_requirements.txt \
-  && rm -f /root/extra_requirements.txt
+  && rm -f /root/extra_packages.txt
 
 # Templates
 #
diff --git a/ubuntu/freeze/pandoc-3.1.13.project.freeze b/ubuntu/freeze/pandoc-3.1.13.project.freeze
new file mode 100644
index 00000000..853fdfcb
--- /dev/null
+++ b/ubuntu/freeze/pandoc-3.1.13.project.freeze
@@ -0,0 +1,336 @@
+active-repositories: hackage.haskell.org:merge
+constraints: any.Cabal ==3.8.1.0,
+             any.Cabal-syntax ==3.8.1.0,
+             any.Glob ==0.10.2,
+             any.HUnit ==1.6.2.0,
+             any.JuicyPixels ==3.3.8,
+             JuicyPixels -mmap,
+             any.OneTuple ==0.4.1.1,
+             any.Only ==0.1,
+             any.QuickCheck ==2.14.3,
+             QuickCheck -old-random +templatehaskell,
+             any.SHA ==1.6.4.4,
+             SHA -exe,
+             any.StateVar ==1.2.2,
+             any.aeson ==2.2.1.0,
+             aeson +ordered-keymap,
+             any.aeson-pretty ==0.8.10,
+             aeson-pretty +lib-only,
+             any.alex ==3.5.1.0,
+             any.ansi-terminal ==1.1.1,
+             ansi-terminal -example,
+             any.ansi-terminal-types ==1.1,
+             any.appar ==0.1.8,
+             any.array ==0.5.4.0,
+             any.asn1-encoding ==0.9.6,
+             any.asn1-parse ==0.9.5,
+             any.asn1-types ==0.3.4,
+             any.assoc ==1.1,
+             assoc +tagged,
+             any.async ==2.2.5,
+             async -bench,
+             any.attoparsec ==0.14.4,
+             attoparsec -developer,
+             any.auto-update ==0.1.6,
+             any.base ==4.17.2.0,
+             any.base-compat ==0.13.1,
+             any.base-orphans ==0.9.2,
+             any.base-unicode-symbols ==0.2.4.2,
+             base-unicode-symbols +base-4-8 -old-base,
+             any.base16-bytestring ==1.0.2.0,
+             any.base64-bytestring ==1.2.1.0,
+             any.basement ==0.0.16,
+             any.bifunctors ==5.6.2,
+             bifunctors +tagged,
+             any.binary ==0.8.9.1,
+             any.bitvec ==1.1.5.0,
+             bitvec +simd,
+             any.blaze-builder ==0.4.2.3,
+             any.blaze-html ==0.9.2.0,
+             any.blaze-markup ==0.8.3.0,
+             any.boring ==0.2.1,
+             boring +tagged,
+             any.bsb-http-chunked ==0.0.0.4,
+             any.byteorder ==1.0.4,
+             any.bytestring ==0.11.5.2,
+             any.cabal-doctest ==1.0.9,
+             any.call-stack ==0.4.0,
+             any.case-insensitive ==1.2.1.0,
+             any.cassava ==0.5.3.1,
+             any.cborg ==0.2.10.0,
+             cborg +optimize-gmp,
+             any.cereal ==0.5.8.3,
+             cereal -bytestring-builder,
+             any.citeproc ==0.8.1,
+             citeproc -executable -icu,
+             any.colour ==2.3.6,
+             any.commonmark ==0.2.6,
+             any.commonmark-extensions ==0.2.5.4,
+             any.commonmark-pandoc ==0.2.2.1,
+             any.comonad ==5.0.8,
+             comonad +containers +distributive +indexed-traversable,
+             any.conduit ==1.3.5,
+             any.conduit-extra ==1.3.6,
+             any.constraints ==0.14.1,
+             any.containers ==0.6.7,
+             any.contravariant ==1.5.5,
+             contravariant +semigroups +statevar +tagged,
+             any.cookie ==0.4.6,
+             any.crypton ==1.0.0,
+             crypton -check_alignment +integer-gmp -old_toolchain_inliner +support_aesni +support_deepseq +support_pclmuldq +support_rdrand -support_sse +use_target_attributes,
+             any.crypton-connection ==0.3.2,
+             any.crypton-x509 ==1.7.6,
+             any.crypton-x509-store ==1.6.9,
+             any.crypton-x509-system ==1.6.7,
+             any.crypton-x509-validation ==1.6.12,
+             any.data-default ==0.7.1.1,
+             any.data-default-class ==0.1.2.0,
+             any.data-default-instances-containers ==0.0.1,
+             any.data-default-instances-dlist ==0.0.1,
+             any.data-default-instances-old-locale ==0.0.1,
+             any.data-fix ==0.3.2,
+             any.dec ==0.0.5,
+             any.deepseq ==1.4.8.0,
+             any.digest ==0.0.2.1,
+             digest -have_arm64_crc32c -have_builtin_prefetch -have_mm_prefetch -have_sse42 -have_strong_getauxval -have_weak_getauxval +pkg-config,
+             any.directory ==1.3.7.1,
+             any.distributive ==0.6.2.1,
+             distributive +semigroups +tagged,
+             any.djot ==0.1.1.3,
+             any.dlist ==1.0,
+             dlist -werror,
+             any.doclayout ==0.4.0.1,
+             any.doctemplates ==0.11,
+             any.easy-file ==0.2.5,
+             any.emojis ==0.1.3,
+             any.exceptions ==0.10.5,
+             any.fast-logger ==3.2.2,
+             any.file-embed ==0.0.16.0,
+             any.filepath ==1.4.2.2,
+             any.foldable1-classes-compat ==0.1,
+             foldable1-classes-compat +tagged,
+             any.generically ==0.1.1,
+             any.ghc-bignum ==1.3,
+             any.ghc-boot-th ==9.4.7,
+             any.ghc-prim ==0.9.1,
+             any.gitrev ==1.3.1,
+             any.gridtables ==0.1.0.0,
+             any.haddock-library ==1.11.0,
+             any.half ==0.3.1,
+             any.happy ==1.20.1.1,
+             any.hashable ==1.4.4.0,
+             hashable +integer-gmp -random-initial-seed,
+             any.haskell-lexer ==1.1.1,
+             any.hourglass ==0.2.12,
+             any.hsc2hs ==0.68.10,
+             hsc2hs -in-ghc-tree,
+             any.hslua ==2.3.1,
+             any.hslua-aeson ==2.3.1,
+             any.hslua-classes ==2.3.1,
+             any.hslua-cli ==1.4.2,
+             hslua-cli -executable,
+             any.hslua-core ==2.3.2,
+             any.hslua-list ==1.1.1,
+             any.hslua-marshalling ==2.3.1,
+             any.hslua-module-doclayout ==1.1.1,
+             any.hslua-module-path ==1.1.1,
+             any.hslua-module-system ==1.1.1,
+             any.hslua-module-text ==1.1.1,
+             any.hslua-module-version ==1.1.1,
+             any.hslua-module-zip ==1.1.1,
+             any.hslua-objectorientation ==2.3.1,
+             any.hslua-packaging ==2.3.1,
+             any.hslua-repl ==0.1.2,
+             hslua-repl -executable,
+             any.hslua-typing ==0.1.1,
+             any.http-api-data ==0.6,
+             http-api-data -use-text-show,
+             any.http-client ==0.7.17,
+             http-client +network-uri,
+             any.http-client-tls ==0.3.6.3,
+             any.http-date ==0.0.11,
+             any.http-media ==0.8.1.1,
+             any.http-types ==0.12.4,
+             any.http2 ==5.0.1,
+             http2 -devel -h2spec,
+             any.indexed-traversable ==0.1.3,
+             any.indexed-traversable-instances ==0.1.1.2,
+             any.integer-conversion ==0.1.0.1,
+             any.integer-gmp ==1.1,
+             any.integer-logarithms ==1.0.3.1,
+             integer-logarithms -check-bounds +integer-gmp,
+             any.iproute ==1.7.12,
+             any.ipynb ==0.2,
+             any.isocline ==1.0.9,
+             any.jira-wiki-markup ==1.5.1,
+             any.libyaml ==0.1.4,
+             libyaml -no-unicode -system-libyaml,
+             any.libyaml-clib ==0.2.5,
+             any.lpeg ==1.1.0,
+             lpeg -rely-on-shared-lpeg-library,
+             any.lua ==2.3.2,
+             lua +allow-unsafe-gc -apicheck -cross-compile -export-dynamic -lua_32bits +pkg-config +system-lua,
+             any.memory ==0.18.0,
+             memory +support_bytestring +support_deepseq,
+             any.microlens ==0.4.13.1,
+             any.microlens-ghc ==0.4.14.3,
+             any.microlens-mtl ==0.2.0.3,
+             any.microlens-th ==0.4.3.15,
+             any.mime-types ==0.1.2.0,
+             any.mmorph ==1.2.0,
+             any.monad-control ==1.0.3.1,
+             any.mono-traversable ==1.0.17.0,
+             any.mtl ==2.2.2,
+             any.network ==3.1.4.0,
+             network -devel,
+             any.network-byte-order ==0.1.7,
+             any.network-control ==0.0.2,
+             any.network-uri ==2.6.4.2,
+             any.old-locale ==1.0.0.7,
+             any.old-time ==1.1.0.4,
+             any.open-browser ==0.2.1.0,
+             any.optparse-applicative ==0.18.1.0,
+             optparse-applicative +process,
+             any.ordered-containers ==0.2.3,
+             any.os-string ==2.0.2.1,
+             any.pandoc ==3.1.13,
+             pandoc +embed_data_files,
+             pandoc-cli +lua -nightly +server,
+             any.pandoc-crossref ==0.3.17.0,
+             pandoc-crossref -enable_flaky_tests,
+             any.pandoc-lua-engine ==0.2.1.3,
+             any.pandoc-lua-marshal ==0.2.6,
+             any.pandoc-server ==0.1.0.5,
+             any.pandoc-types ==1.23.1,
+             any.parsec ==3.1.16.1,
+             any.pem ==0.2.4,
+             any.pretty ==1.1.3.6,
+             any.pretty-show ==1.10,
+             any.prettyprinter ==1.7.1,
+             prettyprinter -buildreadme +text,
+             any.prettyprinter-ansi-terminal ==1.1.3,
+             any.primitive ==0.9.0.0,
+             any.process ==1.6.17.0,
+             any.psqueues ==0.2.8.0,
+             any.random ==1.2.1.2,
+             any.recv ==0.1.0,
+             any.regex-base ==0.94.0.2,
+             any.regex-tdfa ==1.3.2.2,
+             regex-tdfa +doctest -force-o2,
+             any.resourcet ==1.3.0,
+             any.rts ==1.0.2,
+             any.safe ==0.3.21,
+             any.safe-exceptions ==0.1.7.4,
+             any.scientific ==0.3.7.0,
+             scientific -bytestring-builder -integer-simple,
+             any.semialign ==1.3,
+             semialign +semigroupoids,
+             any.semigroupoids ==6.0.0.1,
+             semigroupoids +comonad +containers +contravariant +distributive +tagged +unordered-containers,
+             any.serialise ==0.2.6.1,
+             serialise +newtime15,
+             any.servant ==0.20.1,
+             any.servant-server ==0.20,
+             any.simple-sendfile ==0.2.32,
+             simple-sendfile +allow-bsd -fallback,
+             any.singleton-bool ==0.1.7,
+             any.skylighting ==0.14.1.1,
+             skylighting -executable,
+             any.skylighting-core ==0.14.1.1,
+             skylighting-core -executable,
+             any.skylighting-format-ansi ==0.1,
+             any.skylighting-format-blaze-html ==0.1.1.2,
+             any.skylighting-format-context ==0.1.0.2,
+             any.skylighting-format-latex ==0.1,
+             any.socks ==0.6.1,
+             any.some ==1.0.6,
+             some +newtype-unsafe,
+             any.sop-core ==0.5.0.2,
+             any.split ==0.2.5,
+             any.splitmix ==0.1.0.5,
+             splitmix -optimised-mixer,
+             any.stm ==2.5.1.0,
+             any.streaming-commons ==0.2.2.6,
+             streaming-commons -use-bytestring-builder,
+             any.strict ==0.5,
+             any.string-conversions ==0.4.0.1,
+             any.syb ==0.7.2.4,
+             any.tagged ==0.8.8,
+             tagged +deepseq +transformers,
+             any.tagsoup ==0.14.8,
+             any.template-haskell ==2.19.0.0,
+             any.temporary ==1.3,
+             any.texmath ==0.12.8.8,
+             texmath -executable -server,
+             any.text ==2.0.2,
+             any.text-conversions ==0.3.1.1,
+             any.text-iso8601 ==0.1,
+             any.text-short ==0.1.5,
+             text-short -asserts,
+             any.th-abstraction ==0.6.0.0,
+             any.th-compat ==0.1.5,
+             any.th-lift ==0.8.4,
+             any.th-lift-instances ==0.1.20,
+             any.these ==1.2,
+             any.time ==1.12.2,
+             any.time-compat ==1.9.6.1,
+             time-compat -old-locale,
+             any.time-manager ==0.0.1,
+             any.tls ==2.0.5,
+             tls -devel,
+             any.toml-parser ==2.0.0.0,
+             any.transformers ==0.5.6.2,
+             any.transformers-base ==0.4.6,
+             transformers-base +orphaninstances,
+             any.transformers-compat ==0.7.2,
+             transformers-compat -five +five-three -four +generic-deriving +mtl -three -two,
+             any.typed-process ==0.2.11.1,
+             any.typst ==0.5.0.3,
+             typst -executable,
+             any.typst-symbols ==0.1.6,
+             any.unicode-collation ==0.1.3.6,
+             unicode-collation -doctests -executable,
+             any.unicode-data ==0.4.0.1,
+             unicode-data -ucd2haskell,
+             any.unicode-transforms ==0.4.0.1,
+             unicode-transforms -bench-show -dev -has-icu -has-llvm -use-gauge,
+             any.uniplate ==1.6.13,
+             any.unix ==2.7.3,
+             any.unix-compat ==0.7.1,
+             unix-compat -old-time,
+             any.unix-time ==0.4.12,
+             any.unliftio ==0.2.25.0,
+             any.unliftio-core ==0.2.1.0,
+             any.unordered-containers ==0.2.20,
+             unordered-containers -debug,
+             any.utf8-string ==1.0.2,
+             any.utility-ht ==0.0.17.1,
+             any.uuid-types ==1.0.5.1,
+             any.vault ==0.3.1.5,
+             vault +useghc,
+             any.vector ==0.13.1.0,
+             vector +boundschecks -internalchecks -unsafechecks -wall,
+             any.vector-algorithms ==0.9.0.1,
+             vector-algorithms +bench +boundschecks -internalchecks -llvm +properties -unsafechecks,
+             any.vector-stream ==0.1.0.1,
+             any.wai ==3.2.4,
+             any.wai-app-static ==3.1.9,
+             wai-app-static +crypton -print,
+             any.wai-cors ==0.2.7,
+             any.wai-extra ==3.1.14,
+             wai-extra -build-example,
+             any.wai-logger ==2.4.0,
+             any.warp ==3.3.31,
+             warp +allow-sendfilefd -network-bytestring -warp-debug +x509,
+             any.witherable ==0.4.2,
+             any.word8 ==0.1.3,
+             any.xml ==1.3.14,
+             any.xml-conduit ==1.9.1.3,
+             any.xml-types ==0.3.8,
+             any.yaml ==0.11.11.2,
+             yaml +no-examples +no-exe,
+             any.zip-archive ==0.4.3.2,
+             zip-archive -executable,
+             any.zlib ==0.7.1.0,
+             zlib -bundled-c-zlib +non-blocking-ffi +pkg-config
+index-state: hackage.haskell.org 2024-05-03T13:19:35Z
diff --git a/versions.md b/versions.md
index 7b886ce5..e55edc45 100644
--- a/versions.md
+++ b/versions.md
@@ -1,8 +1,7 @@
 | pandoc   | tags                          | Alpine | Ubuntu | TeXLive | Lua |
 |----------+-------------------------------+--------+--------+---------+-----|
-| main     | edge                          | 3.16.4 | jammy  |         | 5.4 |
-| 3.1.1    | 3.1.1.0  3.1.1  3.1  3 latest | 3.16.4 | jammy  |    2022 | 5.4 |
-| 3.0.1    | 3.0.1.0  3.0.1  3.0           | 3.16.4 | jammy  |    2022 | 5.4 |
-| 2.19.2   | 2.19.2.0 2.19.2 2.19 2        | 3.16.4 | jammy  |    2022 | 5.3 |
-| 2.18     | 2.18.0.0 2.18.0 2.18          | 3.14.8 | focal  |    2021 | 5.3 |
-| 2.17.1.1 | 2.17.1.1 2.17.1 2.17          | 3.14.8 | focal  |    2021 | 5.3 |
+| main     | edge                          | 3.19.1 | noble  |         | 5.4 |
+| 3.1.13   | 3.1.13.0 3.1.13 3.1  3 latest | 3.19.1 | noble  |    2024 | 5.4 |
+| 3.1.1    | 3.1.1.0  3.1.1                | 3.16.8 | jammy  |    2022 | 5.4 |
+| 3.0.1    | 3.0.1.0  3.0.1  3.0           | 3.16.8 | jammy  |    2022 | 5.4 |
+| 2.19.2   | 2.19.2.0 2.19.2 2.19 2        | 3.16.8 | jammy  |    2022 | 5.3 |