diff --git a/DEPENDENCIES.md b/DEPENDENCIES.md
index d91c7d8244..54d09d4df0 100644
--- a/DEPENDENCIES.md
+++ b/DEPENDENCIES.md
@@ -184,7 +184,7 @@ libraries:
     kubernetes          28.1.0     Apache License 2.0
     oauthlib            3.2.2      3-clause BSD license
     orjson              3.9.9      Apache License 2.0, MIT license
-    packaging           23.2       2-clause BSD license, Apache License 2.0
+    packaging           23.1       2-clause BSD license, Apache License 2.0
     pip-tools           7.3.0      3-clause BSD license
     prometheus-client   0.17.1     Apache License 2.0
     pyasn1              0.5.0      2-clause BSD license
@@ -195,11 +195,9 @@ libraries:
     python-json-logger  2.0.7      2-clause BSD license
     requests            2.31.0     Apache License 2.0
     requests-oauthlib   1.3.1      ISC license
-    retrying            1.3.3      Apache License 2.0
     rsa                 4.9        Apache License 2.0
     semantic-version    2.10.0     2-clause BSD license
     six                 1.16.0     MIT license
-    tomli               2.0.1      MIT license
     typing_extensions   4.8.0      Python Software Foundation license
     urllib3             1.26.17    MIT license
     websocket-client    1.6.4      Apache License 2.0
diff --git a/_cxx/envoy.mk b/_cxx/envoy.mk
index 480c334652..433af4c007 100644
--- a/_cxx/envoy.mk
+++ b/_cxx/envoy.mk
@@ -16,7 +16,7 @@ ENVOY_COMMIT ?= 6637fd1bab315774420f3c3d97488fedb7fc710f
 ENVOY_COMPILATION_MODE ?= opt
 # Increment BASE_ENVOY_RELVER on changes to `docker/base-envoy/Dockerfile`, or Envoy recipes.
 # You may reset BASE_ENVOY_RELVER when adjusting ENVOY_COMMIT.
-BASE_ENVOY_RELVER ?= 0
+BASE_ENVOY_RELVER ?= 1
 
 # Set to non-empty to enable compiling Envoy in FIPS mode.
 FIPS_MODE ?=
diff --git a/build-aux/Dockerfile b/build-aux/Dockerfile
index 0644b2892d..7ae45b71a1 100644
--- a/build-aux/Dockerfile
+++ b/build-aux/Dockerfile
@@ -134,7 +134,7 @@ COPY --from=artifacts /opt/image-build /opt/image-build
 RUN /opt/image-build/install.sh
 
 # External Python packages we use
-COPY --from=artifacts /usr/lib/python3.10/site-packages /usr/lib/python3.10/site-packages
+COPY --from=artifacts /usr/lib/python3.11/site-packages /usr/lib/python3.11/site-packages
 
 # Our envoy. The capabilities here grant the wrapper the ability to use the
 # cap_net_bind_service cap and for Envoy to inherit it.
diff --git a/docker/base-envoy/Dockerfile.stripped b/docker/base-envoy/Dockerfile.stripped
index afb3771edf..b2b628683e 100644
--- a/docker/base-envoy/Dockerfile.stripped
+++ b/docker/base-envoy/Dockerfile.stripped
@@ -16,7 +16,7 @@
 # If you have to change this file, you _must_ update BASE_ENVOY_RELVER
 # in the Makefile, then run "make update-base" to build and push the
 # new image.
-FROM frolvlad/alpine-glibc:alpine-3.17_glibc-2.34
+FROM frolvlad/alpine-glibc:alpine-3.18_glibc-2.34
 
 # We use rsync to move things in and out of the container.
 RUN apk add rsync
diff --git a/docker/base-python/Dockerfile b/docker/base-python/Dockerfile
index 4afd270b7e..89ff250791 100644
--- a/docker/base-python/Dockerfile
+++ b/docker/base-python/Dockerfile
@@ -18,7 +18,7 @@
 # Third-party code
 ########################################
 
-FROM docker.io/frolvlad/alpine-glibc:alpine-3.17_glibc-2.34
+FROM docker.io/frolvlad/alpine-glibc:alpine-3.18_glibc-2.34
 
 WORKDIR /buildroot
 
@@ -59,8 +59,8 @@ RUN apk --no-cache add \
   libffi-dev \
   ncurses \
   openssl-dev \
-  py3-pip=~22 \
-  python3=~3.10 \
+  py3-pip \
+  python3=~3.11 \
   python3-dev \
   rust \
   cargo \
diff --git a/docker/test-stats/Dockerfile b/docker/test-stats/Dockerfile
index 59b8fba167..d1810895ef 100644
--- a/docker/test-stats/Dockerfile
+++ b/docker/test-stats/Dockerfile
@@ -15,7 +15,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License
 
-FROM docker.io/frolvlad/alpine-glibc:alpine-3.17
+FROM docker.io/frolvlad/alpine-glibc:alpine-3.18_glibc-2.34
 
 LABEL PROJECT_REPO_URL         = "git@github.com:datawire/ambassador.git" \
       PROJECT_REPO_BROWSER_URL = "https://github.com/datawire/ambassador" \
diff --git a/python/requirements.txt b/python/requirements.txt
index c6cc59b6c8..d8dea87b26 100644
--- a/python/requirements.txt
+++ b/python/requirements.txt
@@ -1,5 +1,5 @@
 #
-# This file is autogenerated by pip-compile with Python 3.10
+# This file is autogenerated by pip-compile with Python 3.11
 # by the following command:
 #
 #    pip-compile --allow-unsafe
diff --git a/tools/src/py-mkopensource/main.go b/tools/src/py-mkopensource/main.go
index feba4e3699..76c92fb164 100644
--- a/tools/src/py-mkopensource/main.go
+++ b/tools/src/py-mkopensource/main.go
@@ -79,6 +79,7 @@ func parseLicenses(name, version, license string) map[License]struct{} {
 		// These are packages with non-trivial strings to parse, and
 		// it's easier to just hard-code it.
 		{"orjson", "3.9.9", "Apache-2.0 OR MIT"}: {Apache2, MIT},
+		{"packaging", "23.1", ""}:                {BSD2, Apache2},
 		{"packaging", "23.2", ""}:                {BSD2, Apache2},
 	}[tuple{name, version, license}]
 	if ok {