diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1a11b1e..15a8659 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,8 +1,9 @@
 name: Build Ruby image
 
-# Break-glass build of `zenjoy/ruby:X.Y.Z-bookworm` when a Ruby (security) release is out and the
-# official `ruby:X.Y.Z-bookworm` image hasn't landed yet. Run it from the Actions tab with the version
-# and the tarball SHA256 from the ruby-lang.org release post. Pull requests only build (no push).
+# Break-glass build of `zenjoy/ruby:X.Y.Z-<suite>` when a Ruby (security) release is out and the
+# official `ruby:X.Y.Z-<suite>` image hasn't landed yet. Run it from the Actions tab with the version,
+# the tarball SHA256 from the ruby-lang.org release post and the Debian suite. Pull requests only
+# build (no push).
 
 on:
   workflow_dispatch:
@@ -15,6 +16,14 @@ on:
         description: 'SHA256 of ruby-X.Y.Z.tar.xz (from the ruby-lang.org release post)'
         required: true
         type: string
+      debian_suite:
+        description: 'Debian suite of the base image'
+        required: true
+        type: choice
+        options:
+          - trixie
+          - bookworm
+        default: trixie
   pull_request:
     paths:
       - 'Dockerfile'
@@ -22,13 +31,14 @@ on:
 
 env:
   REGISTRY_IMAGE: zenjoy/ruby
-  DEBIAN_SUITE: bookworm
+  # Pull requests build trixie.
+  DEBIAN_SUITE: ${{ inputs.debian_suite || 'trixie' }}
   # Version pull requests build as a smoke test.
   PR_RUBY_VERSION: 4.0.9
   PR_RUBY_SHA256: a8057adb39f51ad6dc3106237504c93dd792bb515837b4fe7817ae21ed7e51f4
 
 concurrency:
-  group: build-${{ github.event_name }}-${{ inputs.ruby_version || github.ref }}
+  group: build-${{ github.event_name }}-${{ inputs.ruby_version || github.ref }}-${{ inputs.debian_suite }}
   cancel-in-progress: false
 
 permissions:
@@ -36,7 +46,7 @@ permissions:
 
 jobs:
   build:
-    name: Build Ruby ${{ inputs.ruby_version || 'PR smoke' }} (${{ matrix.platform }})
+    name: Build Ruby ${{ inputs.ruby_version || 'PR smoke' }}-${{ inputs.debian_suite || 'trixie' }} (${{ matrix.platform }})
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -127,7 +137,7 @@ jobs:
           retention-days: 1
 
   merge:
-    name: Publish Ruby ${{ inputs.ruby_version }} manifest
+    name: Publish Ruby ${{ inputs.ruby_version }}-${{ inputs.debian_suite }} manifest
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-24.04
     needs:
diff --git a/Dockerfile b/Dockerfile
index 3d16321..c57162e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,16 +1,18 @@
 # syntax=docker/dockerfile:1
 
-# Mirror of the official Docker Library image (docker-library/ruby, `<major.minor>/bookworm/Dockerfile`),
-# so `zenjoy/ruby:X.Y.Z-bookworm` is a drop-in for `ruby:X.Y.Z-bookworm`. Only the version pin is
-# lifted into build args, so a Ruby security release can be built before the official image lands.
+# Mirror of the official Docker Library image (docker-library/ruby, `<major.minor>/<suite>/Dockerfile`;
+# bookworm and trixie share the template), so `zenjoy/ruby:X.Y.Z-trixie` is a drop-in for
+# `ruby:X.Y.Z-trixie`. Only the version pin and the Debian suite are lifted into build args, so a Ruby
+# security release can be built before the official image lands.
 # Keep the RUN steps in sync with upstream; don't diverge.
 #
 # https://github.com/docker-library/ruby/blob/master/Dockerfile.template
 
-ARG DEBIAN_SUITE=bookworm
+ARG DEBIAN_SUITE=trixie
 
 FROM buildpack-deps:${DEBIAN_SUITE}
 
+ARG DEBIAN_SUITE
 ARG RUBY_VERSION
 ARG RUBY_DOWNLOAD_SHA256
 
@@ -99,7 +101,8 @@ RUN set -eux; \
 		| xargs -r apt-mark manual \
 	; \
 	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
-	rm -rf /var/lib/apt/lists/*; \
+# upstream: `apt-get dist-clean` on trixie and later, bookworm's apt doesn't have it
+	case "$DEBIAN_SUITE" in bookworm) rm -rf /var/lib/apt/lists/* ;; *) apt-get dist-clean ;; esac; \
 	\
 	cd /; \
 	rm -r /usr/src/ruby; \
diff --git a/README.md b/README.md
index 83cafa5..eb9ed6b 100644
--- a/README.md
+++ b/README.md
@@ -3,33 +3,34 @@
 [![Docker Hub](https://img.shields.io/badge/Docker%20Hub-zenjoy%2Fruby-lightgrey?style=flat)](https://hub.docker.com/r/zenjoy/ruby)
 [![License](https://img.shields.io/github/license/zenjoy/docker-ruby)](https://github.com/zenjoy/docker-ruby/blob/main/LICENSE)
 
-A rebuild of the official [`ruby:X.Y.Z-bookworm`](https://hub.docker.com/_/ruby) image, for when a
+A rebuild of the official [`ruby:X.Y.Z-trixie`](https://hub.docker.com/_/ruby) image (or `-bookworm`), for when a
 Ruby security release is out and the official image hasn't been published yet (that usually takes
 16 to 24 hours).
 
 The [Dockerfile](Dockerfile) is the Docker Library one
 ([docker-library/ruby](https://github.com/docker-library/ruby)) with the Ruby version and checksum
-turned into build args. Same base (`buildpack-deps:bookworm`), same configure flags (YJIT, ZJIT on
-Ruby 4.x, full RELRO), so `zenjoy/ruby:4.0.9-bookworm` can stand in for `ruby:4.0.9-bookworm`.
+and the Debian suite turned into build args. Same base (`buildpack-deps:trixie` or `:bookworm`), same
+configure flags (YJIT, ZJIT on Ruby 4.x, full RELRO), so `zenjoy/ruby:4.0.9-trixie` can stand in for
+`ruby:4.0.9-trixie`.
 
 Images are built for `linux/amd64` and `linux/arm64` and pushed to Docker Hub and GHCR:
 
 ```sh
-docker pull zenjoy/ruby:4.0.9-bookworm
-docker pull ghcr.io/zenjoy/ruby:4.0.9-bookworm
+docker pull zenjoy/ruby:4.0.9-trixie
+docker pull ghcr.io/zenjoy/ruby:4.0.9-trixie
 ```
 
-Tags: `X.Y.Z-bookworm` and `X.Y-bookworm`. There is no `latest`.
+Tags: `X.Y.Z-<suite>` and `X.Y-<suite>`, with `<suite>` `trixie` or `bookworm`. There is no `latest`.
 
 ## When to use it
 
 Stay on the official image by default. When a Ruby release fixes something you can't wait for:
 
-1. Run the [Build Ruby image](../../actions/workflows/build.yml) workflow with the version and the
-   SHA256 of `ruby-X.Y.Z.tar.xz` from the ruby-lang.org release post. The workflow also checks it
-   against `cache.ruby-lang.org/pub/ruby/index.txt`.
-2. Point the app's base image at `zenjoy/ruby:X.Y.Z-bookworm`.
-3. Switch back to `ruby:X.Y.Z-bookworm` once the official image is published.
+1. Run the [Build Ruby image](../../actions/workflows/build.yml) workflow with the version, the
+   SHA256 of `ruby-X.Y.Z.tar.xz` from the ruby-lang.org release post, and the Debian suite your app
+   uses. The workflow also checks the SHA256 against `cache.ruby-lang.org/pub/ruby/index.txt`.
+2. Point the app's base image at `zenjoy/ruby:X.Y.Z-<suite>`.
+3. Switch back to `ruby:X.Y.Z-<suite>` once the official image is published.
 
 Nothing rebuilds these images on a schedule, so they don't pick up Debian security updates after
 they're built. Don't stay on one longer than needed.
@@ -37,10 +38,10 @@ they're built. Don't stay on one longer than needed.
 ## Keeping in sync with upstream
 
 When docker-library changes its template (new rustup or Rust pin, configure flags, cleanup steps),
-copy the change into the Dockerfile. Pull requests build the image for both platforms and run a
-smoke test, without pushing.
+copy the change into the Dockerfile. Pull requests build the trixie image for both platforms and run
+a smoke test, without pushing.
 
-Older `zenjoy/ruby` tags without the `-bookworm` suffix (`3.3.10`, `4.0.1`, ...) came from the
+Older `zenjoy/ruby` tags without a suite suffix (`3.3.10`, `4.0.1`, ...) came from the
 previous bullseye-slim build and are no longer updated.
 
 ## Container signatures
@@ -52,7 +53,7 @@ Images are signed with [Cosign](https://docs.sigstore.dev/cosign/overview/) usin
 cosign verify \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
   --certificate-identity-regexp https://github.com/zenjoy/docker-ruby/.github/workflows/ \
-  zenjoy/ruby:4.0.9-bookworm
+  zenjoy/ruby:4.0.9-trixie
 ```
 
 ## License