diff --git a/.github/workflows/base-image.yml b/.github/workflows/base-image.yml
index 71249f9..2f68f12 100644
--- a/.github/workflows/base-image.yml
+++ b/.github/workflows/base-image.yml
@@ -17,7 +17,7 @@ jobs:
     strategy:
       matrix:
         image:
-          - { dir: base, name: lnls-debian-11-epics-7 }
+          - { dir: base, name: lnls-debian-epics-7 }
           - { dir: base/musl, name: lnls-alpine-3-epics-7 }
     env:
       TAG: ${{ github.event_name == 'push' && github.ref_name || github.head_ref }}
@@ -52,7 +52,7 @@ jobs:
         with:
           driver: docker
       - name: Build and push included IOC images
-        if: ${{ matrix.image.name == 'lnls-debian-11-epics-7' }}
+        if: ${{ matrix.image.name == 'lnls-debian-epics-7' }}
         uses: docker/bake-action@v5
         with:
           workdir: images/
diff --git a/CHANGES.md b/CHANGES.md
index 825ec11..ccf8a79 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -13,6 +13,9 @@
   * Failing tests should ideally be fixed. If that isn't possible --- no
     control over upstream, or tests require hardware access --- they can be
     disabled by setting the environment variable `SKIP_TESTS` to  `1`.
+* base: update to Debian 12. by @ericonr in
+  https://github.com/cnpem/epics-in-docker/pull/84
+  * Refer to up to date README for new/updated `RUNTIME_PACKAGES`.
 
 ## v0.12.0
 
diff --git a/Dockerfile b/Dockerfile
index 6e8c8bf..127fa09 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
-ARG DEBIAN_VERSION=11.9
+ARG DEBIAN_VERSION=12.8
 
-FROM ghcr.io/cnpem/lnls-debian-11-epics-7:v0.12.0-dev AS build-image
+FROM ghcr.io/cnpem/lnls-debian-epics-7:v0.12.0-dev AS build-image
 
 FROM debian:${DEBIAN_VERSION}-slim AS base
 
@@ -15,6 +15,7 @@ COPY --from=build-image /etc/apt/apt.conf.d/90-disable-sandbox.conf /etc/apt/apt
 RUN apt update -y && \
     apt install -y --no-install-recommends \
         libreadline8 \
+        libtirpc3 \
         busybox \
         netcat-openbsd \
         procserv \
diff --git a/README.md b/README.md
index 7e077ba..6a21b7d 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ build thin IOC container images.
 ## Base image
 
 The base image is built in CI and should be obtained directly from the [GitHub
-registry](https://github.com/cnpem/epics-in-docker/pkgs/container/lnls-debian-11-epics-7).
+registry](https://github.com/cnpem/epics-in-docker/pkgs/container/lnls-debian-epics-7).
 
 The versions used in the base image are defined in `base/.env`.
 
@@ -92,10 +92,15 @@ with the `make runtests` build system target. However, if these tests fail, and
 it is not possible to fix them (no control over upstream, or tests require
 hardware access), the `SKIP_TESTS` argument can be set to `1`.
 
+### IOCs using PVXS
+
+IOCs using the `PVXS` module to provide `qsrv` and PVA link implementations
+must include `libevent-pthreads-2.1-7` in the `RUNTIME_PACKAGES`.
+
 ### areaDetector IOCs
 
 `areaDetector` IOCs must be built with target `dynamic-link`. In addition, they
-must include `libxml2` and `libtiff5` in the `RUNTIME_PACKAGES`, as they are
+must include `libxml2` and `libtiff6` in the `RUNTIME_PACKAGES`, as they are
 not built in `ADSupport`.
 
 ### Pmac IOCs
diff --git a/base/Dockerfile b/base/Dockerfile
index 7d71d38..1c39ab4 100644
--- a/base/Dockerfile
+++ b/base/Dockerfile
@@ -25,6 +25,7 @@ RUN apt update -y && \
         libxml2-dev \
         libsnmp-dev \
         libssl-dev \
+        libtirpc-dev \
         re2c \
         unzip \
         wget \
@@ -55,7 +56,7 @@ WORKDIR ${EPICS_MODULES_PATH}
 
 COPY backport-ipmicomm.patch ipmicomm.patch caputlog-waveform-fix.patch $EPICS_IN_DOCKER
 COPY modules_versions.sh install_modules.sh $EPICS_IN_DOCKER
-RUN $EPICS_IN_DOCKER/install_modules.sh
+RUN NEEDS_TIRPC=YES $EPICS_IN_DOCKER/install_modules.sh
 
 COPY backport-adsupport-nanohttp.patch $EPICS_IN_DOCKER
 COPY area_detector_versions.sh install_area_detector.sh $EPICS_IN_DOCKER
diff --git a/base/docker-compose.yml b/base/docker-compose.yml
index ef8c1e9..5201a5c 100644
--- a/base/docker-compose.yml
+++ b/base/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   epics-base:
-    image: ${REGISTRY:-ghcr.io/cnpem}/lnls-debian-11-epics-7:$TAG
+    image: ${REGISTRY:-ghcr.io/cnpem}/lnls-debian-epics-7:$TAG
     build:
       context: ./
       dockerfile: Dockerfile
@@ -10,4 +10,4 @@ services:
         org.opencontainers.image.description: "EPICS base and modules build image"
       args:
         JOBS: ${JOBS:--1}
-        DEBIAN_VERSION: 11.9
+        DEBIAN_VERSION: 12.8
diff --git a/images/docker-compose-opcua.yml b/images/docker-compose-opcua.yml
index 3ea3aef..95dfc34 100644
--- a/images/docker-compose-opcua.yml
+++ b/images/docker-compose-opcua.yml
@@ -10,4 +10,4 @@ services:
       args:
         REPONAME: opcua
         RUNDIR: /opt/epics/modules/opcua/iocBoot/iocUaDemoServer
-        RUNTIME_PACKAGES: libxml2 libssl1.1
+        RUNTIME_PACKAGES: libxml2 libssl3