diff --git a/.forgejo/workflows/build_keycloak.yml b/.forgejo/workflows/build_keycloak.yml
index 606ab21..a2b3b81 100644
--- a/.forgejo/workflows/build_keycloak.yml
+++ b/.forgejo/workflows/build_keycloak.yml
@@ -18,17 +18,10 @@ jobs:
         keycloak-version: [ 26.6.1, 26.6.2, 26.6.3 ]
     steps:
       - name: Install required system packages
-        run: apk add --no-cache nodejs maven git
+        run: apk add --no-cache nodejs
 
       - name: Checkout Source Code
-        uses: actions/checkout@v6
-
-      - name: Build attribute-endpoints-provider
-        run: |
-          git clone https://git.hamburg.ccc.de/CCCHH/keycloak-attribute-endpoints-provider.git
-          cd keycloak-attribute-endpoints-provider
-          mvn -f attribute-endpoints-provider verify
-          cp attribute-endpoints-provider/target/attribute-endpoints-provider-1.0-SNAPSHOT.jar ${{ forgejo.workspace }}/keycloak/attribute-endpoints-provider.jar
+        uses: actions/checkout@v7
 
       - name: Build Container
         env:
diff --git a/.forgejo/workflows/build_nextcloud.yml b/.forgejo/workflows/build_nextcloud.yml
index e2538a9..d9772ae 100644
--- a/.forgejo/workflows/build_nextcloud.yml
+++ b/.forgejo/workflows/build_nextcloud.yml
@@ -14,21 +14,40 @@ jobs:
       image: ghcr.io/osscontainertools/kaniko:alpine
     strategy:
       matrix:
-        nextcloud-version: [ 32, 33 ]
+        # renovate: datasource=docker depName=docker.io/library/nextcloud
+        nextcloud-version: [ 33, 34 ]
     steps:
       - name: Install required system packages
-        run: apk add --no-cache nodejs
+        run: apk add --no-cache nodejs git
 
-      - name: Checkout Source Code
-        uses: actions/checkout@v6
+      - name: Checkout source code
+        uses: actions/checkout@v7
 
-      - name: Build Container
+      - name: Checkout nextcloud/docker
+        run: git clone --depth 1 https://github.com/nextcloud/docker.git nextcloud-docker
+
+      - name: Build base Nextcloud image
         env:
           KANIKO_NO_PUSH: ${{ forgejo.ref_name != 'main' }}
           KANIKO_GIT_HAMBURG_CCC_DE_USER: forgejo-actions
           KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ secrets.PACKAGES_TOKEN }}
         run: /kaniko/executor
-          --dockerfile="${{forgejo.workspace }}/nextcloud/Containerfile"
+          --dockerfile="${{ forgejo.workspace }}/nextcloud-docker/${{ matrix.nextcloud-version }}/apache/Dockerfile" 
+          --context="dir://${{ forgejo.workspace }}/nextcloud-docker/${{ matrix.nextcloud-version }}/apache"
+          --build-arg=TAG=${{ matrix.nextcloud-version }}
+          --destination=git.hamburg.ccc.de/ccchh/oci-images/nextcloud-base:${{ matrix.nextcloud-version }}
+          --no-push-cache
+          --credential-helpers=env
+          --annotation=org.opencontainers.image.ref.name=nextcloud-base
+          --annotation=org.opencontainers.image.source=${{ forgejo.server_url }}/${{ forgejo.repository }}
+
+      - name: Build extended image
+        env:
+          KANIKO_NO_PUSH: ${{ forgejo.ref_name != 'main' }}
+          KANIKO_GIT_HAMBURG_CCC_DE_USER: forgejo-actions
+          KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ secrets.PACKAGES_TOKEN }}
+        run: /kaniko/executor
+          --dockerfile="${{ forgejo.workspace }}/nextcloud/Containerfile"
           --context="dir://${{ forgejo.workspace }}/nextcloud"
           --build-arg=TAG=${{ matrix.nextcloud-version }}
           --destination=git.hamburg.ccc.de/ccchh/oci-images/nextcloud:${{ matrix.nextcloud-version }}
diff --git a/keycloak/Containerfile b/keycloak/Containerfile
index f3f6c1e..72ff902 100644
--- a/keycloak/Containerfile
+++ b/keycloak/Containerfile
@@ -1,13 +1,33 @@
 ARG TAG=latest
+
+FROM debian:13-slim as attribute-endpoints-provider-builder
+
+RUN apt-get update \
+    && apt-get install --no-install-recommends --no-install-suggests -y maven git \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN mkdir /maven
+RUN git clone https://git.hamburg.ccc.de/CCCHH/keycloak-attribute-endpoints-provider.git /maven/keycloak-attribute-endpoints-provider
+
+WORKDIR /maven/keycloak-attribute-endpoints-provider
+
+RUN mvn -f attribute-endpoints-provider verify
+
+RUN mv attribute-endpoints-provider/target/attribute-endpoints-provider-*.jar /maven/attribute-endpoints-provider.jar
+
+
 FROM quay.io/keycloak/keycloak:${TAG} as builder
 
 ENV KC_DB=postgres
 ENV KC_FEATURES=declarative-ui
 
 WORKDIR /opt/keycloak
-ADD --chown=keycloak:keycloak --chmod=644 attribute-endpoints-provider.jar /opt/keycloak/providers/attribute-endpoints-provider.jar
+
+COPY --from=attribute-endpoints-provider-builder /maven/attribute-endpoints-provider.jar /opt/keycloak/providers/attribute-endpoints-provider.jar
+
 RUN /opt/keycloak/bin/kc.sh build
 
+
 FROM quay.io/keycloak/keycloak:${TAG}
 COPY --from=builder /opt/keycloak/ /opt/keycloak/
 ADD themes/ /opt/keycloak/themes/
diff --git a/nextcloud/Containerfile b/nextcloud/Containerfile
index d139a4d..d76a998 100644
--- a/nextcloud/Containerfile
+++ b/nextcloud/Containerfile
@@ -1,10 +1,10 @@
-ARG TAG=latest
-FROM docker.io/library/nextcloud:${TAG}
+ARG TAG
+FROM git.hamburg.ccc.de/ccchh/oci-images/nextcloud-base:${TAG}
 
 RUN apt-get update \
     && apt-get install -y supervisor \
     && rm -rf /var/lib/apt/lists/* \
-    && mkdir -p /var/log/supervisord /var/run/supervisord 
+    && mkdir -p /var/log/supervisord /var/run/supervisord
 
 # We need to copy a file to the supervisord folder in /var/run so it exists when the container starts.
 COPY .keep /var/run/supervisord/
@@ -13,4 +13,4 @@ COPY supervisord.conf /
 
 ENV NEXTCLOUD_UPDATE=1
 
-CMD ["/usr/bin/supervisord", "-c", "/supervisord.conf"]
\ No newline at end of file
+CMD ["/usr/bin/supervisord", "-c", "/supervisord.conf"]