diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ac63c45..c996bec 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,6 +9,12 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    groups:
+      baseimage-dependencies:
+          patterns:
+            - "tiiuae/fog-ros-sdk"
+            - "tiiuae/fog-ros-baseimage-builder"
+            - "tiiuae/fog-ros-baseimage"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
diff --git a/.github/workflows/tii-gremsy.yaml b/.github/workflows/tii-gremsy.yaml
index f91d381..9e3574f 100644
--- a/.github/workflows/tii-gremsy.yaml
+++ b/.github/workflows/tii-gremsy.yaml
@@ -1,9 +1,8 @@
 name: Build
 
 on:
-  repository_dispatch:
-    types: [fog-ros-baseimage-update]
   push:
+  pull_request:
   workflow_dispatch:
 
 permissions:
@@ -14,7 +13,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           submodules: recursive
 
@@ -23,41 +22,29 @@ jobs:
         with:
           platforms: amd64,riscv64,arm64
 
-      - uses: docker/setup-buildx-action@v2
-
-      - name: Set image tag format without suffix
-        run: |
-          echo "IMAGE_TAG_FORMAT=type=sha" >> $GITHUB_ENV
-        if: github.event_name == 'push'
-
-      - name: Set image tag format with suffix
-        # it is possible that run_number should be used instead run_attempt
-        # run_attempt is unique number on every run and run_attempt resets to 1 if re-build is not used
-        # content of image_sha_tag_suffix is defined in fog-ros-baseimage dispatcher workflow.
-        run: |
-          echo "IMAGE_TAG_FORMAT=type=sha,suffix=-${{ github.event.client_payload.image_sha_tag_suffix }}" >> $GITHUB_ENV
-        if: github.event_name == 'repository_dispatch'
+      - uses: docker/setup-buildx-action@v3
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: ghcr.io/tiiuae/tii-gremsy
           tags: |
             type=ref,event=branch
+            type=ref,event=pr
             type=semver,pattern={{version}}
-            type=raw,value=latest
-            ${{ env.IMAGE_TAG_FORMAT }}
+            type=sha
+            type=raw,value=latest,enable=${{ endsWith(github.ref, github.event.repository.default_branch) }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build container image and push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: .
           platforms: linux/amd64,linux/riscv64,linux/arm64
diff --git a/Dockerfile b/Dockerfile
index 3f2c72c..49915e6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM --platform=${BUILDPLATFORM:-linux/amd64} ghcr.io/tiiuae/fog-ros-sdk:sha-f8defd3-${TARGETARCH:-amd64} AS builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} ghcr.io/tiiuae/fog-ros-sdk:sha-6d67ecf-${TARGETARCH:-amd64} AS builder
 
 # Must be defined another time after "FROM" keyword.
 ARG TARGETARCH
@@ -15,7 +15,7 @@ RUN /packaging/build_colcon_sdk.sh ${TARGETARCH:-amd64}
 #  ▲               runtime ──┐
 #  └── build                 ▼
 
-FROM ghcr.io/tiiuae/fog-ros-baseimage:feat-multiarch-pkcs11
+FROM ghcr.io/tiiuae/fog-ros-baseimage:sha-6d67ecf
 
 # ENTRYPOINT exec ros-with-env ros2 run ros2_gremsy gremsy_node --ros-args --remap __ns:=/$DRONE_DEVICE_ID -p com_port:=/dev/ttyUSB0
 ENTRYPOINT [ "/entrypoint.sh" ]