diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 9b3e656e..4a116805 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -9,13 +9,11 @@ on:
       - '1.7'
       - '1.8'
       - master
-      # version tags, e.g. 1.7.1
-      - '[1-9].[0-9].[0-9]'
-      # pre-releases, e.g. 1.8-pre1
-      - 1.8-pre[0-9]
       # test branches, e.g. test-debian
       - test-*
 
+concurrency: ci-${{ github.ref }}
+
 ###############################################
 # REQUIRED secrets
 # DOCKER_UN: ${{ secrets.Docker_Login }}
@@ -28,6 +26,18 @@ on:
 #    The docker repository for test images. Only used for the branch TESTING (BORS try).
 # Add the above secrets to your github repo to determine where the images will be pushed.
 ################################################
+# Code block that is used as one liner.
+##!/bin/bash
+#version=$( git tag --list "{{ env.MAILU_VERSION }}.*" | tail -1  )
+#root_version=${version%.*}
+#patch_version=${version##*.}
+#if [ "$patch_version" == "" ]
+#then
+#  pinned_version={{ env.MAILU_VERSION }}.0
+#else
+#  pinned_version=$root_version.$(expr $patch_version + 1)
+#fi
+#echo "PINNED_MAILU_VERSION=$pinned_version" >> $GITHUB_ENV
 
 jobs:
   build:
@@ -35,27 +45,49 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
+        with:
+          # fetch-depth 0 is required to also retrieve all tags.
+          fetch-depth: 0
       - name: Extract branch name
         shell: bash
         run: |
           echo "BRANCH=${GITHUB_REF#refs/heads/}" >> $GITHUB_ENV
         #For branch TESTING, we set the image tag to PR-xxxx
-      - name: Derive MAILU_VERSION for branch testing
+      - name: Derive MAILU_VERSION and PINNED_MAILU_VERSION for branch testing
         if: ${{ env.BRANCH == 'testing' }}
         shell: bash
         env:
           COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          DOCKER_ORG_TESTS: ${{ secrets.DOCKER_ORG_TESTS }}
         run: |
           echo "MAILU_VERSION=pr-${COMMIT_MESSAGE//[!0-9]/}" >> $GITHUB_ENV
-          echo "DOCKER_ORG=${{ secrets.DOCKER_ORG_TESTS }}" >> $GITHUB_ENV
+          echo "PINNED_MAILU_VERSION=pr-${COMMIT_MESSAGE//[!0-9]/}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG_TESTS" >> $GITHUB_ENV
       - name: Derive MAILU_VERSION for other branches than testing
         if: ${{ env.BRANCH != 'testing' }}
         shell: bash
         env:
-          MAILU_BRANCH: ${{ env.BRANCH }}
+          DOCKER_ORG: ${{ secrets.DOCKER_ORG }}
         run: |
-          echo "MAILU_VERSION=${{ env.MAILU_BRANCH }}" >> $GITHUB_ENV
-          echo "DOCKER_ORG=${{ secrets.DOCKER_ORG }}" >> $GITHUB_ENV
+          echo "MAILU_VERSION=${{ env.BRANCH }}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for normal release x.y
+        if: ${{ env.BRANCH != 'testing' && env.BRANCH != 'staging' && env.BRANCH != 'master' }}
+        shell: bash
+        run: |
+          version=$( git tag --list "${{ env.MAILU_VERSION }}.*" | tail -1  );root_version=${version%.*};patch_version=${version##*.};if [ "$patch_version" == "" ]; then pinned_version=${{ env.MAILU_VERSION }}.0; else pinned_version=$root_version.$(expr $patch_version + 1); fi;echo "PINNED_MAILU_VERSION=$pinned_version" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for staging
+        if: ${{ env.BRANCH == 'staging' }}
+        shell: bash
+        run: |
+          echo "PINNED_MAILU_VERSION=staging" >> $GITHUB_ENV      
+      - name: Derive PINNED_MAILU_VERSION for master
+        if: ${{ env.BRANCH == 'master' }}
+        shell: bash
+        env:
+          GITHUB_SHA: ${{ env.GITHUB_SHA }}
+        run: |
+          echo "PINNED_MAILU_VERSION=$GITHUB_SHA" >> $GITHUB_ENV
       - name: Create folder for storing images
         run: |
           sudo mkdir -p /images
@@ -76,7 +108,7 @@ jobs:
       - name: Build all docker images
         env:
           MAILU_VERSION: ${{ env.MAILU_VERSION }}
-          TRAVIS_BRANCH: ${{ env.BRANCH }}
+          PINNED_MAILU_VERSION: ${{ env.PINNED_MAILU_VERSION }}
           DOCKER_ORG: ${{ env.DOCKER_ORG }}
         run: docker-compose -f tests/build.yml build
       - name: Save all docker images
@@ -89,26 +121,49 @@ jobs:
       - build
     steps:
       - uses: actions/checkout@v2
+        with:
+          # fetch-depth 0 is required to also retrieve all tags.
+          fetch-depth: 0
       - name: Extract branch name
         shell: bash
         run: |
           echo "BRANCH=${GITHUB_REF#refs/heads/}" >> $GITHUB_ENV
-      - name: Derive MAILU_VERSION for branch testing
+        #For branch TESTING, we set the image tag to PR-xxxx
+      - name: Derive MAILU_VERSION and PINNED_MAILU_VERSION for branch testing
         if: ${{ env.BRANCH == 'testing' }}
         shell: bash
         env:
           COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          DOCKER_ORG_TESTS: ${{ secrets.DOCKER_ORG_TESTS }}
         run: |
           echo "MAILU_VERSION=pr-${COMMIT_MESSAGE//[!0-9]/}" >> $GITHUB_ENV
-          echo "DOCKER_ORG=${{ secrets.DOCKER_ORG_TESTS }}" >> $GITHUB_ENV
+          echo "PINNED_MAILU_VERSION=pr-${COMMIT_MESSAGE//[!0-9]/}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG_TESTS" >> $GITHUB_ENV
       - name: Derive MAILU_VERSION for other branches than testing
         if: ${{ env.BRANCH != 'testing' }}
         shell: bash
         env:
-          MAILU_BRANCH: ${{ env.BRANCH }}
+          DOCKER_ORG: ${{ secrets.DOCKER_ORG }}
         run: |
-          echo "MAILU_VERSION=${{ env.MAILU_BRANCH }}" >> $GITHUB_ENV
-          echo "DOCKER_ORG=${{ secrets.DOCKER_ORG }}" >> $GITHUB_ENV
+          echo "MAILU_VERSION=${{ env.BRANCH }}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for normal release x.y
+        if: ${{ env.BRANCH != 'testing' && env.BRANCH != 'master' }}
+        shell: bash
+        run: |
+          version=$( git tag --list "${{ env.MAILU_VERSION }}.*" | tail -1  );root_version=${version%.*};patch_version=${version##*.};if [ "$patch_version" == "" ]; then pinned_version=${{ env.MAILU_VERSION }}.0; else pinned_version=$root_version.$(expr $patch_version + 1); fi;echo "PINNED_MAILU_VERSION=$pinned_version" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for staging
+        if: ${{ env.BRANCH == 'staging' }}
+        shell: bash
+        run: |
+          echo "PINNED_MAILU_VERSION=staging" >> $GITHUB_ENV          
+      - name: Derive PINNED_MAILU_VERSION for master
+        if: ${{ env.BRANCH == 'master' }}
+        shell: bash
+        env:
+          GITHUB_SHA: ${{ env.GITHUB_SHA }}
+        run: |
+          echo "PINNED_MAILU_VERSION=$GITHUB_SHA" >> $GITHUB_ENV
       - name: Create folder for storing images
         run: |
           sudo mkdir -p /images
@@ -128,7 +183,7 @@ jobs:
         run: python tests/compose/test.py core 2
         env:
           MAILU_VERSION: ${{ env.MAILU_VERSION }}
-          TRAVIS_BRANCH: ${{ env.BRANCH }}
+          PINNED_MAILU_VERSION: ${{ env.PINNED_MAILU_VERSION }}
           DOCKER_ORG: ${{ env.DOCKER_ORG }}
 
   test-fetchmail:
@@ -138,26 +193,49 @@ jobs:
       - build
     steps:
       - uses: actions/checkout@v2
+        with:
+          # fetch-depth 0 is required to also retrieve all tags.
+          fetch-depth: 0
       - name: Extract branch name
         shell: bash
         run: |
           echo "BRANCH=${GITHUB_REF#refs/heads/}" >> $GITHUB_ENV
-      - name: Derive MAILU_VERSION for branch testing
+        #For branch TESTING, we set the image tag to PR-xxxx
+      - name: Derive MAILU_VERSION and PINNED_MAILU_VERSION for branch testing
         if: ${{ env.BRANCH == 'testing' }}
         shell: bash
         env:
           COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          DOCKER_ORG_TESTS: ${{ secrets.DOCKER_ORG_TESTS }}
         run: |
           echo "MAILU_VERSION=pr-${COMMIT_MESSAGE//[!0-9]/}" >> $GITHUB_ENV
-          echo "DOCKER_ORG=${{ secrets.DOCKER_ORG_TESTS }}" >> $GITHUB_ENV
+          echo "PINNED_MAILU_VERSION=pr-${COMMIT_MESSAGE//[!0-9]/}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG_TESTS" >> $GITHUB_ENV
       - name: Derive MAILU_VERSION for other branches than testing
         if: ${{ env.BRANCH != 'testing' }}
         shell: bash
         env:
-          MAILU_BRANCH: ${{ env.BRANCH }}
+          DOCKER_ORG: ${{ secrets.DOCKER_ORG }}
         run: |
-          echo "MAILU_VERSION=${{ env.MAILU_BRANCH }}" >> $GITHUB_ENV
-          echo "DOCKER_ORG=${{ secrets.DOCKER_ORG }}" >> $GITHUB_ENV
+          echo "MAILU_VERSION=${{ env.BRANCH }}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for normal release x.y
+        if: ${{ env.BRANCH != 'testing' && env.BRANCH != 'master' }}
+        shell: bash
+        run: |
+          version=$( git tag --list "${{ env.MAILU_VERSION }}.*" | tail -1  );root_version=${version%.*};patch_version=${version##*.};if [ "$patch_version" == "" ]; then pinned_version=${{ env.MAILU_VERSION }}.0; else pinned_version=$root_version.$(expr $patch_version + 1); fi;echo "PINNED_MAILU_VERSION=$pinned_version" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for staging
+        if: ${{ env.BRANCH == 'staging' }}
+        shell: bash
+        run: |
+          echo "PINNED_MAILU_VERSION=staging" >> $GITHUB_ENV          
+      - name: Derive PINNED_MAILU_VERSION for master
+        if: ${{ env.BRANCH == 'master' }}
+        shell: bash
+        env:
+          GITHUB_SHA: ${{ env.GITHUB_SHA }}
+        run: |
+          echo "PINNED_MAILU_VERSION=$GITHUB_SHA" >> $GITHUB_ENV
       - name: Create folder for storing images
         run: |
           sudo mkdir -p /images
@@ -177,7 +255,7 @@ jobs:
         run: python tests/compose/test.py fetchmail 2
         env:
           MAILU_VERSION: ${{ env.MAILU_VERSION }}
-          TRAVIS_BRANCH: ${{ env.BRANCH }}
+          PINNED_MAILU_VERSION: ${{ env.PINNED_MAILU_VERSION }}
           DOCKER_ORG: ${{ env.DOCKER_ORG }}
 
   test-filters:
@@ -187,26 +265,49 @@ jobs:
       - build
     steps:
       - uses: actions/checkout@v2
+        with:
+          # fetch-depth 0 is required to also retrieve all tags.
+          fetch-depth: 0
       - name: Extract branch name
         shell: bash
         run: |
           echo "BRANCH=${GITHUB_REF#refs/heads/}" >> $GITHUB_ENV
-      - name: Derive MAILU_VERSION for branch testing
+        #For branch TESTING, we set the image tag to PR-xxxx
+      - name: Derive MAILU_VERSION and PINNED_MAILU_VERSION for branch testing
         if: ${{ env.BRANCH == 'testing' }}
         shell: bash
         env:
           COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          DOCKER_ORG_TESTS: ${{ secrets.DOCKER_ORG_TESTS }}
         run: |
           echo "MAILU_VERSION=pr-${COMMIT_MESSAGE//[!0-9]/}" >> $GITHUB_ENV
-          echo "DOCKER_ORG=${{ secrets.DOCKER_ORG_TESTS }}" >> $GITHUB_ENV
+          echo "PINNED_MAILU_VERSION=pr-${COMMIT_MESSAGE//[!0-9]/}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG_TESTS" >> $GITHUB_ENV
       - name: Derive MAILU_VERSION for other branches than testing
         if: ${{ env.BRANCH != 'testing' }}
         shell: bash
         env:
-          MAILU_BRANCH: ${{ env.BRANCH }}
+          DOCKER_ORG: ${{ secrets.DOCKER_ORG }}
         run: |
-          echo "MAILU_VERSION=${{ env.MAILU_BRANCH }}" >> $GITHUB_ENV
-          echo "DOCKER_ORG=${{ secrets.DOCKER_ORG }}" >> $GITHUB_ENV
+          echo "MAILU_VERSION=${{ env.BRANCH }}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for normal release x.y
+        if: ${{ env.BRANCH != 'testing' && env.BRANCH != 'master' }}
+        shell: bash
+        run: |
+          version=$( git tag --list "${{ env.MAILU_VERSION }}.*" | tail -1  );root_version=${version%.*};patch_version=${version##*.};if [ "$patch_version" == "" ]; then pinned_version=${{ env.MAILU_VERSION }}.0; else pinned_version=$root_version.$(expr $patch_version + 1); fi;echo "PINNED_MAILU_VERSION=$pinned_version" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for staging
+        if: ${{ env.BRANCH == 'staging' }}
+        shell: bash
+        run: |
+          echo "PINNED_MAILU_VERSION=staging" >> $GITHUB_ENV          
+      - name: Derive PINNED_MAILU_VERSION for master
+        if: ${{ env.BRANCH == 'master' }}
+        shell: bash
+        env:
+          GITHUB_SHA: ${{ env.GITHUB_SHA }}
+        run: |
+          echo "PINNED_MAILU_VERSION=$GITHUB_SHA" >> $GITHUB_ENV
       - name: Create folder for storing images
         run: |
           sudo mkdir -p /images
@@ -226,7 +327,7 @@ jobs:
         run: python tests/compose/test.py filters 3
         env:
           MAILU_VERSION: ${{ env.MAILU_VERSION }}
-          TRAVIS_BRANCH: ${{ env.BRANCH }}
+          PINNED_MAILU_VERSION: ${{ env.PINNED_MAILU_VERSION }}
           DOCKER_ORG: ${{ env.DOCKER_ORG }}
 
   test-rainloop:
@@ -236,26 +337,49 @@ jobs:
       - build
     steps:
       - uses: actions/checkout@v2
+        with:
+          # fetch-depth 0 is required to also retrieve all tags.
+          fetch-depth: 0
       - name: Extract branch name
         shell: bash
         run: |
           echo "BRANCH=${GITHUB_REF#refs/heads/}" >> $GITHUB_ENV
-      - name: Derive MAILU_VERSION for branch testing
+        #For branch TESTING, we set the image tag to PR-xxxx
+      - name: Derive MAILU_VERSION and PINNED_MAILU_VERSION for branch testing
         if: ${{ env.BRANCH == 'testing' }}
         shell: bash
         env:
           COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          DOCKER_ORG_TESTS: ${{ secrets.DOCKER_ORG_TESTS }}
         run: |
           echo "MAILU_VERSION=pr-${COMMIT_MESSAGE//[!0-9]/}" >> $GITHUB_ENV
-          echo "DOCKER_ORG=${{ secrets.DOCKER_ORG_TESTS }}" >> $GITHUB_ENV
+          echo "PINNED_MAILU_VERSION=pr-${COMMIT_MESSAGE//[!0-9]/}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG_TESTS" >> $GITHUB_ENV
       - name: Derive MAILU_VERSION for other branches than testing
         if: ${{ env.BRANCH != 'testing' }}
         shell: bash
         env:
-          MAILU_BRANCH: ${{ env.BRANCH }}
+          DOCKER_ORG: ${{ secrets.DOCKER_ORG }}
         run: |
-          echo "MAILU_VERSION=${{ env.MAILU_BRANCH }}" >> $GITHUB_ENV
-          echo "DOCKER_ORG=${{ secrets.DOCKER_ORG }}" >> $GITHUB_ENV
+          echo "MAILU_VERSION=${{ env.BRANCH }}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for normal release x.y
+        if: ${{ env.BRANCH != 'testing' && env.BRANCH != 'master' }}
+        shell: bash
+        run: |
+          version=$( git tag --list "${{ env.MAILU_VERSION }}.*" | tail -1  );root_version=${version%.*};patch_version=${version##*.};if [ "$patch_version" == "" ]; then pinned_version=${{ env.MAILU_VERSION }}.0; else pinned_version=$root_version.$(expr $patch_version + 1); fi;echo "PINNED_MAILU_VERSION=$pinned_version" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for staging
+        if: ${{ env.BRANCH == 'staging' }}
+        shell: bash
+        run: |
+          echo "PINNED_MAILU_VERSION=staging" >> $GITHUB_ENV          
+      - name: Derive PINNED_MAILU_VERSION for master
+        if: ${{ env.BRANCH == 'master' }}
+        shell: bash
+        env:
+          GITHUB_SHA: ${{ env.GITHUB_SHA }}
+        run: |
+          echo "PINNED_MAILU_VERSION=$GITHUB_SHA" >> $GITHUB_ENV
       - name: Create folder for storing images
         run: |
           sudo mkdir -p /images
@@ -275,7 +399,7 @@ jobs:
         run: python tests/compose/test.py rainloop 2
         env:
           MAILU_VERSION: ${{ env.MAILU_VERSION }}
-          TRAVIS_BRANCH: ${{ env.BRANCH }}
+          PINNED_MAILU_VERSION: ${{ env.PINNED_MAILU_VERSION }}
           DOCKER_ORG: ${{ env.DOCKER_ORG }}
 
   test-roundcube:
@@ -285,26 +409,49 @@ jobs:
       - build
     steps:
       - uses: actions/checkout@v2
+        with:
+          # fetch-depth 0 is required to also retrieve all tags.
+          fetch-depth: 0
       - name: Extract branch name
         shell: bash
         run: |
           echo "BRANCH=${GITHUB_REF#refs/heads/}" >> $GITHUB_ENV
-      - name: Derive MAILU_VERSION for branch testing
+        #For branch TESTING, we set the image tag to PR-xxxx
+      - name: Derive MAILU_VERSION and PINNED_MAILU_VERSION for branch testing
         if: ${{ env.BRANCH == 'testing' }}
         shell: bash
         env:
           COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          DOCKER_ORG_TESTS: ${{ secrets.DOCKER_ORG_TESTS }}
         run: |
           echo "MAILU_VERSION=pr-${COMMIT_MESSAGE//[!0-9]/}" >> $GITHUB_ENV
-          echo "DOCKER_ORG=${{ secrets.DOCKER_ORG_TESTS }}" >> $GITHUB_ENV
+          echo "PINNED_MAILU_VERSION=pr-${COMMIT_MESSAGE//[!0-9]/}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG_TESTS" >> $GITHUB_ENV
       - name: Derive MAILU_VERSION for other branches than testing
         if: ${{ env.BRANCH != 'testing' }}
         shell: bash
         env:
-          MAILU_BRANCH: ${{ env.BRANCH }}
+          DOCKER_ORG: ${{ secrets.DOCKER_ORG }}
         run: |
-          echo "MAILU_VERSION=${{ env.MAILU_BRANCH }}" >> $GITHUB_ENV
-          echo "DOCKER_ORG=${{ secrets.DOCKER_ORG }}" >> $GITHUB_ENV
+          echo "MAILU_VERSION=${{ env.BRANCH }}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for normal release x.y
+        if: ${{ env.BRANCH != 'testing' && env.BRANCH != 'master' }}
+        shell: bash
+        run: |
+          version=$( git tag --list "${{ env.MAILU_VERSION }}.*" | tail -1  );root_version=${version%.*};patch_version=${version##*.};if [ "$patch_version" == "" ]; then pinned_version=${{ env.MAILU_VERSION }}.0; else pinned_version=$root_version.$(expr $patch_version + 1); fi;echo "PINNED_MAILU_VERSION=$pinned_version" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for staging
+        if: ${{ env.BRANCH == 'staging' }}
+        shell: bash
+        run: |
+          echo "PINNED_MAILU_VERSION=staging" >> $GITHUB_ENV          
+      - name: Derive PINNED_MAILU_VERSION for master
+        if: ${{ env.BRANCH == 'master' }}
+        shell: bash
+        env:
+          GITHUB_SHA: ${{ env.GITHUB_SHA }}
+        run: |
+          echo "PINNED_MAILU_VERSION=$GITHUB_SHA" >> $GITHUB_ENV
       - name: Create folder for storing images
         run: |
           sudo mkdir -p /images
@@ -324,7 +471,7 @@ jobs:
         run: python tests/compose/test.py roundcube 2
         env:
           MAILU_VERSION: ${{ env.MAILU_VERSION }}
-          TRAVIS_BRANCH: ${{ env.BRANCH }}
+          PINNED_MAILU_VERSION: ${{ env.PINNED_MAILU_VERSION }}
           DOCKER_ORG: ${{ env.DOCKER_ORG }}
 
   test-webdav:
@@ -334,26 +481,49 @@ jobs:
       - build
     steps:
       - uses: actions/checkout@v2
+        with:
+          # fetch-depth 0 is required to also retrieve all tags.
+          fetch-depth: 0
       - name: Extract branch name
         shell: bash
         run: |
           echo "BRANCH=${GITHUB_REF#refs/heads/}" >> $GITHUB_ENV
-      - name: Derive MAILU_VERSION for branch testing
+        #For branch TESTING, we set the image tag to PR-xxxx
+      - name: Derive MAILU_VERSION and PINNED_MAILU_VERSION for branch testing
         if: ${{ env.BRANCH == 'testing' }}
         shell: bash
         env:
           COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          DOCKER_ORG_TESTS: ${{ secrets.DOCKER_ORG_TESTS }}
         run: |
           echo "MAILU_VERSION=pr-${COMMIT_MESSAGE//[!0-9]/}" >> $GITHUB_ENV
-          echo "DOCKER_ORG=${{ secrets.DOCKER_ORG_TESTS }}" >> $GITHUB_ENV
+          echo "PINNED_MAILU_VERSION=pr-${COMMIT_MESSAGE//[!0-9]/}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG_TESTS" >> $GITHUB_ENV
       - name: Derive MAILU_VERSION for other branches than testing
         if: ${{ env.BRANCH != 'testing' }}
         shell: bash
         env:
-          MAILU_BRANCH: ${{ env.BRANCH }}
+          DOCKER_ORG: ${{ secrets.DOCKER_ORG }}
         run: |
-          echo "MAILU_VERSION=${{ env.MAILU_BRANCH }}" >> $GITHUB_ENV
-          echo "DOCKER_ORG=${{ secrets.DOCKER_ORG }}" >> $GITHUB_ENV
+          echo "MAILU_VERSION=${{ env.BRANCH }}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for normal release x.y
+        if: ${{ env.BRANCH != 'testing' && env.BRANCH != 'master' }}
+        shell: bash
+        run: |
+          version=$( git tag --list "${{ env.MAILU_VERSION }}.*" | tail -1  );root_version=${version%.*};patch_version=${version##*.};if [ "$patch_version" == "" ]; then pinned_version=${{ env.MAILU_VERSION }}.0; else pinned_version=$root_version.$(expr $patch_version + 1); fi;echo "PINNED_MAILU_VERSION=$pinned_version" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for staging
+        if: ${{ env.BRANCH == 'staging' }}
+        shell: bash
+        run: |
+          echo "PINNED_MAILU_VERSION=staging" >> $GITHUB_ENV          
+      - name: Derive PINNED_MAILU_VERSION for master
+        if: ${{ env.BRANCH == 'master' }}
+        shell: bash
+        env:
+          GITHUB_SHA: ${{ env.GITHUB_SHA }}
+        run: |
+          echo "PINNED_MAILU_VERSION=$GITHUB_SHA" >> $GITHUB_ENV
       - name: Create folder for storing images
         run: |
           sudo mkdir -p /images
@@ -373,7 +543,7 @@ jobs:
         run: python tests/compose/test.py webdav 2
         env:
           MAILU_VERSION: ${{ env.MAILU_VERSION }}
-          TRAVIS_BRANCH: ${{ env.BRANCH }}
+          PINNED_MAILU_VERSION: ${{ env.PINNED_MAILU_VERSION }}
           DOCKER_ORG: ${{ env.DOCKER_ORG }}
 
   deploy:
@@ -389,27 +559,49 @@ jobs:
       - test-webdav
     steps:
       - uses: actions/checkout@v2
+        with:
+          # fetch-depth 0 is required to also retrieve all tags.
+          fetch-depth: 0
       - name: Extract branch name
         shell: bash
         run: |
           echo "BRANCH=${GITHUB_REF#refs/heads/}" >> $GITHUB_ENV
         #For branch TESTING, we set the image tag to PR-xxxx
-      - name: Derive MAILU_VERSION for branch testing
+      - name: Derive MAILU_VERSION and PINNED_MAILU_VERSION for branch testing
         if: ${{ env.BRANCH == 'testing' }}
         shell: bash
         env:
           COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          DOCKER_ORG_TESTS: ${{ secrets.DOCKER_ORG_TESTS }}
         run: |
           echo "MAILU_VERSION=pr-${COMMIT_MESSAGE//[!0-9]/}" >> $GITHUB_ENV
-          echo "DOCKER_ORG=${{ secrets.DOCKER_ORG_TESTS }}" >> $GITHUB_ENV
+          echo "PINNED_MAILU_VERSION=pr-${COMMIT_MESSAGE//[!0-9]/}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG_TESTS" >> $GITHUB_ENV
       - name: Derive MAILU_VERSION for other branches than testing
         if: ${{ env.BRANCH != 'testing' }}
         shell: bash
         env:
-          MAILU_BRANCH: ${{ env.BRANCH }}
+          DOCKER_ORG: ${{ secrets.DOCKER_ORG }}
         run: |
-          echo "MAILU_VERSION=${{ env.MAILU_BRANCH }}" >> $GITHUB_ENV
-          echo "DOCKER_ORG=${{ secrets.DOCKER_ORG }}" >> $GITHUB_ENV
+          echo "MAILU_VERSION=${{ env.BRANCH }}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for normal release x.y
+        if: ${{ env.BRANCH != 'testing' && env.BRANCH != 'master' }}
+        shell: bash
+        run: |
+          version=$( git tag --list "${{ env.MAILU_VERSION }}.*" | tail -1  );root_version=${version%.*};patch_version=${version##*.};if [ "$patch_version" == "" ]; then pinned_version=${{ env.MAILU_VERSION }}.0; else pinned_version=$root_version.$(expr $patch_version + 1); fi;echo "PINNED_MAILU_VERSION=$pinned_version" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for staging
+        if: ${{ env.BRANCH == 'staging' }}
+        shell: bash
+        run: |
+          echo "PINNED_MAILU_VERSION=staging" >> $GITHUB_ENV          
+      - name: Derive PINNED_MAILU_VERSION for master
+        if: ${{ env.BRANCH == 'master' }}
+        shell: bash
+        env:
+          GITHUB_SHA: ${{ env.GITHUB_SHA }}
+        run: |
+          echo "PINNED_MAILU_VERSION=$GITHUB_SHA" >> $GITHUB_ENV
       - name: Create folder for storing images
         run: |
           sudo mkdir -p /images
@@ -430,13 +622,49 @@ jobs:
           DOCKER_PW: ${{ secrets.Docker_Password }}
           DOCKER_ORG: ${{ env.DOCKER_ORG }}
           MAILU_VERSION: ${{ env.MAILU_VERSION }}
-          TRAVIS_BRANCH: ${{ env.BRANCH }}
+          PINNED_MAILU_VERSION: ${{ env.PINNED_MAILU_VERSION }}
+          BRANCH: ${{ env.BRANCH }}
         run: bash tests/deploy.sh
 
+  tag-release:
+    runs-on: ubuntu-latest
+    needs:
+      - deploy
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          # fetch-depth 0 is required to also retrieve all tags.
+          fetch-depth: 0
+      - name: Extract branch name
+        shell: bash
+        run: |
+          echo "BRANCH=${GITHUB_REF#refs/heads/}" >> $GITHUB_ENV
+      - name: Derive MAILU_VERSION amd DOCKER_ORG
+        if: ${{ env.BRANCH != 'testing' && env.BRANCH != 'staging' && env.BRANCH != 'master' }}
+        shell: bash
+        env:
+          DOCKER_ORG: ${{ secrets.DOCKER_ORG }}
+        run: |
+          echo "MAILU_VERSION=${{ env.BRANCH }}" >> $GITHUB_ENV
+          echo "DOCKER_ORG=$DOCKER_ORG" >> $GITHUB_ENV
+      - name: Derive PINNED_MAILU_VERSION for normal release x.y
+        if: ${{ env.BRANCH != 'testing' && env.BRANCH != 'staging' && env.BRANCH != 'master' }}
+        shell: bash
+        run: |
+          version=$( git tag --list "${{ env.MAILU_VERSION }}.*" | tail -1  );root_version=${version%.*};patch_version=${version##*.};if [ "$patch_version" == "" ]; then pinned_version=${{ env.MAILU_VERSION }}.0; else pinned_version=$root_version.$(expr $patch_version + 1); fi;echo "PINNED_MAILU_VERSION=$pinned_version" >> $GITHUB_ENV
+      - name: Tag and create release
+        if: ${{ env.BRANCH != 'testing' && env.BRANCH != 'staging' && env.BRANCH != 'master' && env.PINNED_MAILU_VERSION != '' }}
+        uses: ncipollo/release-action@v1
+        with:
+          bodyFile: "RELEASE_TEMPLATE.md"
+          commit: ${{ env.GITHUB_SHA }}
+          tag: ${{ env.PINNED_MAILU_VERSION }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
  # This job is watched by bors. It only complets if building,testing and deploy worked.
   ci-success:
     name: CI-Done
-    #Returns true when none of the **previous** steps have failed or been canceled.
+    #Returns true when none of the **previous** steps have failed or have been canceled.
     if: ${{ success() }}
     needs:
       - deploy
diff --git a/RELEASE_TEMPLATE.md b/RELEASE_TEMPLATE.md
new file mode 100644
index 00000000..48178938
--- /dev/null
+++ b/RELEASE_TEMPLATE.md
@@ -0,0 +1,10 @@
+This is a new automatic release of Mailu. The new version can be seen in the tag name.
+The main version X.Y (e.g. 1.8) will always reflect the latest version of the branch. To update your Mailu installation simply pull the latest images `docker-compose pull && docker-compose up -d`.
+The pinned version X.Y.Z (e.g. 1.8.1) is not updated. It is pinned to the commit that was used for creating this release. You can use a pinned version to make sure your Mailu installation is not suddenly updated when recreating containers. The pinned version allows the user to manually update. It also allows to go back to a previous pinned version.
+
+To check what was changed:
+- Go to https://github.com/Mailu/Mailu/tree/master/towncrier/newsfragments
+- Change the branch to the tag of this release.
+- Read the news fragment files to check what was changed.
+
+The release notes of the original release can be accessed via menu item 'Release notes' on [mailu.io](https://mailu.io/).
\ No newline at end of file
diff --git a/core/admin/Dockerfile b/core/admin/Dockerfile
index 1958ae61..fde7c877 100644
--- a/core/admin/Dockerfile
+++ b/core/admin/Dockerfile
@@ -21,10 +21,13 @@ RUN set -eu \
 
 # Actual application
 FROM $DISTRO
+ARG VERSION
 COPY --from=balenalib/rpi-alpine:3.14 /usr/bin/qemu-arm-static /usr/bin/qemu-arm-static
 
 ENV TZ Etc/UTC
 
+LABEL version=$VERSION
+
 # python3 shared with most images
 RUN set -eu \
  && apk add --no-cache python3 py3-pip py3-wheel git bash tzdata \
@@ -56,3 +59,4 @@ ENV FLASK_APP mailu
 CMD /start.py
 
 HEALTHCHECK CMD curl -f -L http://localhost/sso/login?next=ui.index || exit 1
+RUN echo $VERSION >> /version
\ No newline at end of file
diff --git a/core/admin/mailu/internal/nginx.py b/core/admin/mailu/internal/nginx.py
index 027db935..9271df8e 100644
--- a/core/admin/mailu/internal/nginx.py
+++ b/core/admin/mailu/internal/nginx.py
@@ -27,12 +27,12 @@ STATUSES = {
     }),
 }
 
-def check_credentials(user, password, ip, protocol=None):
+def check_credentials(user, password, ip, protocol=None, auth_port=None):
     if not user or not user.enabled or (protocol == "imap" and not user.enable_imap) or (protocol == "pop3" and not user.enable_pop):
         return False
     is_ok = False
     # webmails
-    if len(password) == 64 and ip == app.config['WEBMAIL_ADDRESS']:
+    if len(password) == 64 and auth_port in ['10143', '10025']:
         if user.verify_temp_token(password):
             is_ok = True
     # All tokens are 32 characters hex lowercase
@@ -100,7 +100,7 @@ def handle_authentication(headers):
                 app.logger.warn(f'Invalid user {user_email!r}: {exc}')
             else:
                 ip = urllib.parse.unquote(headers["Client-Ip"])
-                if check_credentials(user, password, ip, protocol):
+                if check_credentials(user, password, ip, protocol, headers["Auth-Port"]):
                     server, port = get_server(headers["Auth-Protocol"], True)
                     return {
                         "Auth-Status": "OK",
diff --git a/core/admin/mailu/utils.py b/core/admin/mailu/utils.py
index 024c487f..755be013 100644
--- a/core/admin/mailu/utils.py
+++ b/core/admin/mailu/utils.py
@@ -66,10 +66,10 @@ def has_dane_record(domain, timeout=10):
         return app.config['DEFER_ON_TLS_ERROR']
     except dns.exception.Timeout:
         app.logger.warn(f'Timeout while resolving the TLSA record for {domain} ({timeout}s).')
-    except dns.resolver.NXDOMAIN:
+    except (dns.resolver.NXDOMAIN, dns.name.EmptyLabel):
         pass # this is expected, not TLSA record is fine
     except Exception as e:
-        app.logger.error(f'Error while looking up the TLSA record for {domain} {e}')
+        app.logger.info(f'Error while looking up the TLSA record for {domain} {e}')
         pass
 
 # Rate limiter
diff --git a/core/dovecot/Dockerfile b/core/dovecot/Dockerfile
index 7a2dbdc1..16f35490 100644
--- a/core/dovecot/Dockerfile
+++ b/core/dovecot/Dockerfile
@@ -11,9 +11,11 @@ RUN git clone https://github.com/grosjo/fts-xapian.git \
   && make install
 
 FROM $DISTRO
-
+ARG VERSION
 ENV TZ Etc/UTC
 
+LABEL version=$VERSION
+
 # python3 shared with most images
 RUN apk add --no-cache \
     python3 py3-pip git bash py3-multidict py3-yarl tzdata \
@@ -41,3 +43,4 @@ VOLUME ["/mail"]
 CMD /start.py
 
 HEALTHCHECK --start-period=350s CMD echo QUIT|nc localhost 110|grep "Dovecot ready."
+RUN echo $VERSION >> /version
\ No newline at end of file
diff --git a/core/nginx/Dockerfile b/core/nginx/Dockerfile
index d8899144..744de810 100644
--- a/core/nginx/Dockerfile
+++ b/core/nginx/Dockerfile
@@ -1,8 +1,11 @@
 ARG DISTRO=alpine:3.14.2
 FROM $DISTRO
+ARG VERSION
 
 ENV TZ Etc/UTC
 
+LABEL version=$VERSION
+
 # python3 shared with most images
 RUN apk add --no-cache \
     python3 py3-pip git bash py3-multidict \
@@ -28,3 +31,4 @@ VOLUME ["/overrides"]
 CMD /start.py
 
 HEALTHCHECK CMD curl -k -f -L http://localhost/health || exit 1
+RUN echo $VERSION >> /version
\ No newline at end of file
diff --git a/core/nginx/conf/nginx.conf b/core/nginx/conf/nginx.conf
index 71cbf9ee..62e5c54b 100644
--- a/core/nginx/conf/nginx.conf
+++ b/core/nginx/conf/nginx.conf
@@ -277,7 +277,7 @@ mail {
       listen 10143;
       protocol imap;
       smtp_auth plain;
-      auth_http_header Auth-Port 10043;
+      auth_http_header Auth-Port 10143;
     }
 
     # SMTP is always enabled, to avoid losing emails when TLS is failing
diff --git a/core/postfix/Dockerfile b/core/postfix/Dockerfile
index 9f0cc701..deedd9b8 100644
--- a/core/postfix/Dockerfile
+++ b/core/postfix/Dockerfile
@@ -1,8 +1,12 @@
 ARG DISTRO=alpine:3.14.2
+
 FROM $DISTRO
+ARG VERSION
 
 ENV TZ Etc/UTC
 
+LABEL version=$VERSION
+
 # python3 shared with most images
 RUN apk add --no-cache \
     python3 py3-pip git bash py3-multidict py3-yarl tzdata \
@@ -30,3 +34,4 @@ VOLUME ["/queue"]
 CMD /start.py
 
 HEALTHCHECK --start-period=350s CMD echo QUIT|nc localhost 25|grep "220 .* ESMTP Postfix"
+RUN echo $VERSION >> /version
\ No newline at end of file
diff --git a/core/postfix/start.py b/core/postfix/start.py
index 06a097b8..ac675cf1 100755
--- a/core/postfix/start.py
+++ b/core/postfix/start.py
@@ -42,6 +42,7 @@ def is_valid_postconf_line(line):
             and not line == ''
 
 # Actual startup script
+os.environ['DEFER_ON_TLS_ERROR'] = os.environ['DEFER_ON_TLS_ERROR'] if 'DEFER_ON_TLS_ERROR' in os.environ else 'True'
 os.environ["FRONT_ADDRESS"] = system.get_host_address_from_environment("FRONT", "front")
 os.environ["ADMIN_ADDRESS"] = system.get_host_address_from_environment("ADMIN", "admin")
 os.environ["ANTISPAM_MILTER_ADDRESS"] = system.get_host_address_from_environment("ANTISPAM_MILTER", "antispam:11332")
diff --git a/core/rspamd/Dockerfile b/core/rspamd/Dockerfile
index 6ec211c4..412d69db 100644
--- a/core/rspamd/Dockerfile
+++ b/core/rspamd/Dockerfile
@@ -1,8 +1,10 @@
 ARG DISTRO=alpine:3.15
 FROM $DISTRO
-
+ARG VERSION
 ENV TZ Etc/UTC
 
+LABEL version=$VERSION
+
 # python3 shared with most images
 RUN apk add --no-cache \
     python3 py3-pip git bash py3-multidict tzdata \
@@ -26,3 +28,4 @@ VOLUME ["/var/lib/rspamd"]
 CMD /start.py
 
 HEALTHCHECK --start-period=350s CMD curl -f -L http://localhost:11334/ || exit 1
+RUN echo $VERSION >> /version
\ No newline at end of file
diff --git a/docs/Dockerfile b/docs/Dockerfile
index 289697da..18ca8333 100644
--- a/docs/Dockerfile
+++ b/docs/Dockerfile
@@ -19,7 +19,10 @@ RUN apk add --no-cache --virtual .build-deps \
 FROM nginx:1.21-alpine
 
 ARG version=master
+ARG pinned_version=master
 ENV VERSION=$version
+ENV TZ Etc/UTC
+LABEL version=$VERSION
 
 COPY ./nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /build/$VERSION /build/$VERSION
@@ -27,3 +30,4 @@ COPY --from=build /build/$VERSION /build/$VERSION
 EXPOSE 80/tcp
 
 CMD nginx -g "daemon off;"
+RUN echo $pinned_version >> /version
\ No newline at end of file
diff --git a/optional/clamav/Dockerfile b/optional/clamav/Dockerfile
index e17d2d70..97a47d30 100644
--- a/optional/clamav/Dockerfile
+++ b/optional/clamav/Dockerfile
@@ -1,8 +1,11 @@
 ARG DISTRO=alpine:3.14.2
 FROM $DISTRO
+ARG VERSION
 
 ENV TZ Etc/UTC
 
+LABEL version=$VERSION
+
 # python3 shared with most images
 RUN apk add --no-cache \
     python3 py3-pip bash tzdata \
@@ -20,3 +23,4 @@ VOLUME ["/data"]
 CMD /start.py
 
 HEALTHCHECK --start-period=350s CMD /health.sh
+RUN echo $VERSION >> /version
\ No newline at end of file
diff --git a/optional/fetchmail/Dockerfile b/optional/fetchmail/Dockerfile
index 068a5dce..81ccc2d1 100644
--- a/optional/fetchmail/Dockerfile
+++ b/optional/fetchmail/Dockerfile
@@ -1,8 +1,11 @@
 ARG DISTRO=alpine:3.14.2
 FROM $DISTRO
+ARG VERSION
 
 ENV TZ Etc/UTC
 
+LABEL version=$VERSION
+
 # python3 shared with most images
 RUN apk add --no-cache \
     python3 py3-pip bash tzdata \
@@ -16,4 +19,5 @@ RUN mkdir -p /data
 
 COPY fetchmail.py /fetchmail.py
 
-CMD ["/fetchmail.py"]
\ No newline at end of file
+CMD ["/fetchmail.py"]
+RUN echo $VERSION >> /version
\ No newline at end of file
diff --git a/optional/radicale/Dockerfile b/optional/radicale/Dockerfile
index 4eb8d5a7..93796eb1 100644
--- a/optional/radicale/Dockerfile
+++ b/optional/radicale/Dockerfile
@@ -1,8 +1,11 @@
 ARG DISTRO=alpine:3.14.2
 FROM $DISTRO
+ARG VERSION
 
 ENV TZ Etc/UTC
 
+LABEL version=$VERSION
+
 # python3 shared with most images
 RUN apk add --no-cache \
     python3 py3-pip bash tzdata \
@@ -21,3 +24,4 @@ VOLUME ["/data"]
 CMD radicale -S -C /radicale.conf
 
 HEALTHCHECK CMD curl -f -L http://localhost:5232/ || exit 1
+RUN echo $VERSION >> /version
\ No newline at end of file
diff --git a/optional/traefik-certdumper/Dockerfile b/optional/traefik-certdumper/Dockerfile
index 506c09c2..829655f0 100644
--- a/optional/traefik-certdumper/Dockerfile
+++ b/optional/traefik-certdumper/Dockerfile
@@ -1,7 +1,10 @@
 FROM ldez/traefik-certs-dumper
+ARG VERSION
 
 ENV TZ Etc/UTC
 
+LABEL version=$VERSION
+
 RUN apk --no-cache add inotify-tools util-linux bash tzdata
 
 COPY run.sh /
@@ -10,3 +13,4 @@ VOLUME ["/traefik"]
 VOLUME ["/output"]
 
 ENTRYPOINT ["/run.sh"]
+RUN echo $VERSION >> /version
\ No newline at end of file
diff --git a/optional/unbound/Dockerfile b/optional/unbound/Dockerfile
index bf5d4840..3a86cc6c 100644
--- a/optional/unbound/Dockerfile
+++ b/optional/unbound/Dockerfile
@@ -1,8 +1,11 @@
 ARG DISTRO=alpine:3.14.2
 FROM $DISTRO
+ARG VERSION
 
 ENV TZ Etc/UTC
 
+LABEL version=$VERSION
+
 # python3 shared with most images
 RUN apk add --no-cache \
     python3 py3-pip git bash py3-multidict tzdata \
@@ -27,3 +30,4 @@ EXPOSE 53/udp 53/tcp
 CMD /start.py
 
 HEALTHCHECK CMD dig @127.0.0.1 || exit 1
+RUN echo $VERSION >> /version
\ No newline at end of file
diff --git a/setup/Dockerfile b/setup/Dockerfile
index e0f685ee..baa35da9 100644
--- a/setup/Dockerfile
+++ b/setup/Dockerfile
@@ -1,5 +1,9 @@
 ARG DISTRO=alpine:3.14.2
 FROM $DISTRO
+ARG VERSION
+ENV TZ Etc/UTC
+LABEL version=$VERSION
+
 
 RUN mkdir -p /app
 WORKDIR /app
@@ -17,3 +21,4 @@ COPY static ./static
 EXPOSE 80/tcp
 
 CMD gunicorn -w 4 -b :80 --access-logfile - --error-logfile - --preload main:app
+RUN echo $VERSION >> /version
\ No newline at end of file
diff --git a/tests/build.yml b/tests/build.yml
index 178cb02c..da351ac8 100644
--- a/tests/build.yml
+++ b/tests/build.yml
@@ -3,65 +3,107 @@ version: '3'
 services:
 
   front:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}nginx:${MAILU_VERSION:-local}
-    build: ../core/nginx
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}nginx:${PINNED_MAILU_VERSION:-local}
+    build:
+      context: ../core/nginx
+      args:
+        VERSION: ${PINNED_MAILU_VERSION:-local}
 
   resolver:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-local}
-    build: ../optional/unbound
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}unbound:${PINNED_MAILU_VERSION:-local}
+    build:
+      context: ../optional/unbound
+      args:
+        VERSION: ${PINNED_MAILU_VERSION:-local}
 
   imap:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${MAILU_VERSION:-local}
-    build: ../core/dovecot
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${PINNED_MAILU_VERSION:-local}
+    build:
+      context: ../core/dovecot
+      args:
+        VERSION: ${PINNED_MAILU_VERSION:-local}
 
   smtp:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}postfix:${MAILU_VERSION:-local}
-    build: ../core/postfix
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}postfix:${PINNED_MAILU_VERSION:-local}
+    build:
+      context: ../core/postfix
+      args:
+        VERSION: ${PINNED_MAILU_VERSION:-local}
 
   antispam:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rspamd:${MAILU_VERSION:-local}
-    build: ../core/rspamd
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rspamd:${PINNED_MAILU_VERSION:-local}
+    build:
+      context: ../core/rspamd
+      args:
+        VERSION: ${PINNED_MAILU_VERSION:-local}
 
   antivirus:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}clamav:${MAILU_VERSION:-local}
-    build: ../optional/clamav
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}clamav:${PINNED_MAILU_VERSION:-local}
+    build:
+      context: ../optional/clamav
+      args:
+        VERSION: ${PINNED_MAILU_VERSION:-local}
 
   webdav:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}radicale:${MAILU_VERSION:-local}
-    build: ../optional/radicale
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}radicale:${PINNED_MAILU_VERSION:-local}
+    build:
+      context: ../optional/radicale
+      args:
+        VERSION: ${PINNED_MAILU_VERSION:-local}
 
   traefik-certdumper:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}traefik-certdumper:${MAILU_VERSION:-local}
-    build: ../optional/traefik-certdumper
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}traefik-certdumper:${PINNED_MAILU_VERSION:-local}
+    build:
+      context: ../optional/traefik-certdumper
+      args:
+        VERSION: ${PINNED_MAILU_VERSION:-local}
 
   admin:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}admin:${MAILU_VERSION:-local}
-    build: ../core/admin
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}admin:${PINNED_MAILU_VERSION:-local}
+    build:
+      context: ../core/admin
+      args:
+        VERSION: ${PINNED_MAILU_VERSION:-local}
 
   roundcube:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}roundcube:${MAILU_VERSION:-local}
-    build: ../webmails/roundcube
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}roundcube:${PINNED_MAILU_VERSION:-local}
+    build:
+      context: ../webmails/roundcube
+      args:
+        VERSION: ${PINNED_MAILU_VERSION:-local}
 
   rainloop:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rainloop:${MAILU_VERSION:-local}
-    build: ../webmails/rainloop
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rainloop:${PINNED_MAILU_VERSION:-local}
+    build:
+      context: ../webmails/rainloop
+      args:
+        VERSION: ${PINNED_MAILU_VERSION:-local}
 
   fetchmail:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}fetchmail:${MAILU_VERSION:-local}
-    build: ../optional/fetchmail
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}fetchmail:${PINNED_MAILU_VERSION:-local}
+    build:
+      context: ../optional/fetchmail
+      args:
+        VERSION: ${PINNED_MAILU_VERSION:-local}
 
   none:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}none:${MAILU_VERSION:-local}
-    build: ../core/none
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}none:${PINNED_MAILU_VERSION:-local}
+    build:
+      context: ../core/none
+      args:
+        VERSION: ${PINNED_MAILU_VERSION:-local}
 
   docs:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}docs:${MAILU_VERSION:-local}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}docs:${PINNED_MAILU_VERSION:-local}
     build:
       context: ../docs
       args:
         version: ${MAILU_VERSION:-local}
+        pinned_version: ${PINNED_MAILU_VERSION:-local}
 
   setup:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}setup:${MAILU_VERSION:-local}
-    build: ../setup
-
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}setup:${PINNED_MAILU_VERSION:-local}
+    build:
+      context: ../setup
+      args:
+        VERSION: ${PINNED_MAILU_VERSION:-local}
diff --git a/tests/compose/core/docker-compose.yml b/tests/compose/core/docker-compose.yml
index f64c82b0..195d8a59 100644
--- a/tests/compose/core/docker-compose.yml
+++ b/tests/compose/core/docker-compose.yml
@@ -15,7 +15,7 @@ services:
 
   # Core services
   front:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}nginx:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}nginx:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     logging:
@@ -34,7 +34,7 @@ services:
       - "/mailu/certs:/certs"
 
   admin:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}admin:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}admin:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -44,7 +44,7 @@ services:
       - redis
 
   imap:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -54,7 +54,7 @@ services:
       - front
 
   smtp:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}postfix:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}postfix:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -63,7 +63,7 @@ services:
       - front
 
   antispam:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rspamd:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rspamd:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
diff --git a/tests/compose/fetchmail/docker-compose.yml b/tests/compose/fetchmail/docker-compose.yml
index 49c292e9..d31479d4 100644
--- a/tests/compose/fetchmail/docker-compose.yml
+++ b/tests/compose/fetchmail/docker-compose.yml
@@ -15,7 +15,7 @@ services:
 
   # Core services
   front:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}nginx:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}nginx:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     logging:
@@ -34,7 +34,7 @@ services:
       - "/mailu/certs:/certs"
 
   admin:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}admin:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}admin:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -44,7 +44,7 @@ services:
       - redis
 
   imap:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -54,7 +54,7 @@ services:
       - front
 
   smtp:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}postfix:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}postfix:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -63,7 +63,7 @@ services:
       - front
 
   antispam:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rspamd:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rspamd:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -77,7 +77,7 @@ services:
 
 
   fetchmail:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}fetchmail:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}fetchmail:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
 
diff --git a/tests/compose/filters/docker-compose.yml b/tests/compose/filters/docker-compose.yml
index 94b97399..381d3683 100644
--- a/tests/compose/filters/docker-compose.yml
+++ b/tests/compose/filters/docker-compose.yml
@@ -15,7 +15,7 @@ services:
 
   # Core services
   front:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}nginx:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}nginx:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     logging:
@@ -34,7 +34,7 @@ services:
       - "/mailu/certs:/certs"
 
   admin:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}admin:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}admin:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -44,7 +44,7 @@ services:
       - redis
 
   imap:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -54,7 +54,7 @@ services:
       - front
 
   smtp:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}postfix:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}postfix:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -63,7 +63,7 @@ services:
       - front
 
   antispam:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rspamd:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rspamd:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -75,7 +75,7 @@ services:
 
   # Optional services
   antivirus:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}clamav:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}clamav:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
diff --git a/tests/compose/rainloop/docker-compose.yml b/tests/compose/rainloop/docker-compose.yml
index 98425d7a..62d5890f 100644
--- a/tests/compose/rainloop/docker-compose.yml
+++ b/tests/compose/rainloop/docker-compose.yml
@@ -15,7 +15,7 @@ services:
 
   # Core services
   front:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}nginx:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}nginx:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     logging:
@@ -34,7 +34,7 @@ services:
       - "/mailu/certs:/certs"
 
   admin:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}admin:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}admin:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -44,7 +44,7 @@ services:
       - redis
 
   imap:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -54,7 +54,7 @@ services:
       - front
 
   smtp:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}postfix:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}postfix:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -63,7 +63,7 @@ services:
       - front
 
   antispam:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rspamd:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rspamd:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -79,7 +79,7 @@ services:
 
   # Webmail
   webmail:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rainloop:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rainloop:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
diff --git a/tests/compose/roundcube/docker-compose.yml b/tests/compose/roundcube/docker-compose.yml
index b2f415df..0bb54e8c 100644
--- a/tests/compose/roundcube/docker-compose.yml
+++ b/tests/compose/roundcube/docker-compose.yml
@@ -15,7 +15,7 @@ services:
 
   # Core services
   front:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}nginx:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}nginx:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     logging:
@@ -34,7 +34,7 @@ services:
       - "/mailu/certs:/certs"
 
   admin:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}admin:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}admin:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -44,7 +44,7 @@ services:
       - redis
 
   imap:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -54,7 +54,7 @@ services:
       - front
 
   smtp:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}postfix:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}postfix:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -63,7 +63,7 @@ services:
       - front
 
   antispam:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rspamd:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rspamd:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -79,7 +79,7 @@ services:
 
   # Webmail
   webmail:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}roundcube:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}roundcube:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
diff --git a/tests/compose/webdav/docker-compose.yml b/tests/compose/webdav/docker-compose.yml
index adc094a8..a597b2d2 100644
--- a/tests/compose/webdav/docker-compose.yml
+++ b/tests/compose/webdav/docker-compose.yml
@@ -15,7 +15,7 @@ services:
 
   # Core services
   front:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}nginx:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}nginx:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     logging:
@@ -34,7 +34,7 @@ services:
       - "/mailu/certs:/certs"
 
   admin:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}admin:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}admin:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -44,7 +44,7 @@ services:
       - redis
 
   imap:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}dovecot:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -54,7 +54,7 @@ services:
       - front
 
   smtp:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}postfix:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}postfix:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -63,7 +63,7 @@ services:
       - front
 
   antispam:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rspamd:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rspamd:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
@@ -76,7 +76,7 @@ services:
   # Optional services
 
   webdav:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}radicale:${MAILU_VERSION:-master}
+    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}radicale:${PINNED_MAILU_VERSION:-local}
     restart: always
     env_file: mailu.env
     volumes:
diff --git a/tests/deploy.sh b/tests/deploy.sh
index abb37b6b..db843b9c 100755
--- a/tests/deploy.sh
+++ b/tests/deploy.sh
@@ -1,7 +1,51 @@
 #!/bin/bash
 
 # Skip deploy for staging branch
-[ "$TRAVIS_BRANCH" = "staging" ] && exit 0
+[ "$BRANCH" = "staging" ] && exit 0
 
 docker login -u $DOCKER_UN -p $DOCKER_PW
+
+if [ "$BRANCH" = "testing" ]
+then
+  docker-compose -f tests/build.yml push
+  exit 0
+fi
+
+#Deploy for main releases
+#Images are built with tag PINNED_MAILU_VERSION (x.y.z).
+#We are tagging them as well with MAILU_VERSION (x.y)
+#After that, both tags are pushed to the docker repository.
+if [ "$PINNED_MAILU_VERSION" != "" ] && [ "$BRANCH" != "master" ]
+then
+  images=$(docker-compose -f tests/build.yml config | awk -F ':' '/image:/{ print $2 }')
+  for image in $images
+  do
+    docker tag "${image}":"${PINNED_MAILU_VERSION}" "${image}":${MAILU_VERSION}
+  done
+#Push PINNED_MAILU_VERSION images
+  docker-compose -f tests/build.yml push
+#Push MAILU_VERSION images
+  PINNED_MAILU_VERSION=$MAILU_VERSION
+  docker-compose -f tests/build.yml push
+  exit 0
+fi
+
+#Deploy for master. For master we only publish images with tag master
+#Images are built with tag PINNED_MAILU_VERSION (commit hash).
+#We are tagging them as well with MAILU_VERSION (master)
+#Then we publish the images with tag master
+if [ "$PINNED_MAILU_VERSION" != "" ] && [ "$BRANCH" == "master" ]
+then
+  images=$(docker-compose -f tests/build.yml config | awk -F ':' '/image:/{ print $2 }')
+  for image in $images
+  do
+    docker tag "${image}":"${PINNED_MAILU_VERSION}" "${image}":${MAILU_VERSION}
+  done
+#Push MAILU_VERSION images
+  PINNED_MAILU_VERSION=$MAILU_VERSION
+  docker-compose -f tests/build.yml push
+  exit 0
+fi
+
+#Fallback in case $PINNED_MAILU_VERSION is empty. This should never execute.
 docker-compose -f tests/build.yml push
diff --git a/towncrier/newsfragments/1182.feature b/towncrier/newsfragments/1182.feature
new file mode 100644
index 00000000..51ff61cb
--- /dev/null
+++ b/towncrier/newsfragments/1182.feature
@@ -0,0 +1,10 @@
+Use semantic versioning for building releases.
+- Add versioning (tagging) for branch x.y (1.8). E.g. 1.8.0, 1.8.1 etc.
+  - docker repo will contain x.y (latest) and x.y.z (pinned version) images.
+  - The X.Y.Z tag is incremented automatically. E.g. if 1.8.0 already exists, then the next merge on 1.8 will result in the new tag 1.8.1 being used.
+- Make the version available in the image.
+  -  For X.Y and X.Y.Z write the version (X.Y.Z) into /version on the image and add a label with version=X.Y.Z
+	  -  This means that the latest X.Y image shows the pinned version (X.Y.Z e.g. 1.8.1) it was based on. Via the tag X.Y.Z you can see the commit hash that triggered the built.
+  -  For master write the commit hash into /version on the image and add a label with version={commit hash}
+-  Automatic releases. For x.y triggered builts (e.g. merge on 1.9) do a new github release for the pinned x.y.z (e.g. 1.9.2). 
+  -  Release shows a static message (see RELEASE_TEMPLATE.md) that explains how to reach the newsfragments folder and change the branch to the tag (x.y.z) mentioned in the release. Now you can get the changelog by reading all newsfragment files in this folder.
\ No newline at end of file
diff --git a/towncrier/newsfragments/2079.fix b/towncrier/newsfragments/2079.fix
new file mode 100644
index 00000000..82350ff6
--- /dev/null
+++ b/towncrier/newsfragments/2079.fix
@@ -0,0 +1,2 @@
+#2079 Webmail token check does not work if WEBMAIL_ADDRESS is set to a hostname.
+#2081 Fix typo in nginx config for webmail port (10043 to 10143)
\ No newline at end of file
diff --git a/webmails/rainloop/Dockerfile b/webmails/rainloop/Dockerfile
index 02910e39..0938056c 100644
--- a/webmails/rainloop/Dockerfile
+++ b/webmails/rainloop/Dockerfile
@@ -2,10 +2,13 @@ ARG ARCH=""
 
 # NOTE: only add file if building for arm
 FROM ${ARCH}alpine:3.14
+ARG VERSION
 ONBUILD COPY --from=balenalib/rpi-alpine:3.14 /usr/bin/qemu-arm-static /usr/bin/qemu-arm-static
 
 ENV TZ Etc/UTC
 
+LABEL version=$VERSION
+
 # Shared later between dovecot postfix nginx rspamd rainloop and roundloop
 RUN apk add --no-cache \
     python3 py3-pip tzdata \
@@ -71,3 +74,4 @@ VOLUME ["/data"]
 CMD php-fpm7 && /start.py
 
 HEALTHCHECK CMD curl -f -L http://localhost/ || exit 1
+RUN echo $VERSION >> /version
\ No newline at end of file
diff --git a/webmails/roundcube/Dockerfile b/webmails/roundcube/Dockerfile
index 4ad89022..f28f316c 100644
--- a/webmails/roundcube/Dockerfile
+++ b/webmails/roundcube/Dockerfile
@@ -7,9 +7,11 @@ ONBUILD COPY --from=balenalib/rpi-alpine:3.14 /usr/bin/qemu-arm-static /usr/bin/
 FROM ${ARCH}php:7.4-apache as build_other
 
 FROM build_${QEMU}
-
+ARG VERSION
 ENV TZ Etc/UTC
 
+LABEL version=$VERSION
+
 #Shared layer between rainloop and roundcube
 RUN apt-get update && apt-get install -y \
   python3 curl python3-pip git python3-multidict tzdata \
@@ -59,3 +61,4 @@ VOLUME ["/data"]
 CMD /start.py
 
 HEALTHCHECK CMD curl -f -L -H 'User-Agent: health' http://localhost/ || exit 1
+RUN echo $VERSION >> /version
\ No newline at end of file