diff --git a/.gitea/workflows/telegraf-snmp-unifi.yaml b/.gitea/workflows/telegraf-snmp-unifi.yaml
index 2bd2f18..627c381 100644
--- a/.gitea/workflows/telegraf-snmp-unifi.yaml
+++ b/.gitea/workflows/telegraf-snmp-unifi.yaml
@@ -10,6 +10,7 @@ on:
       - '.gitea/workflows/telegraf-snmp-unifi.yaml'
     tags:
       - 'v*'
+  workflow_dispatch:
 
 env:
   RESULT_IMAGE_NAME: tools/telegraf-snmp-unifi
diff --git a/README.md b/README.md
index 7ca79e2..05ec1c8 100644
--- a/README.md
+++ b/README.md
@@ -16,3 +16,15 @@
 | `git tag v1.0.0 && git push origin v1.0.0` | `:<sha>` + `:v1.0.0` |
 
 `:latest` wird nur durch Pushes auf `main` überschrieben. Feature-Branches bauen immer, lassen `:latest` aber unberührt.
+
+## Rebuild without code changes
+
+To trigger a rebuild (e.g. to pull latest `apt upgrade`):
+
+**Option 1 — empty commit:**
+```bash
+git commit --allow-empty -m "chore: rebuild to pull latest apt upgrades"
+git push
+```
+
+**Option 2 — manual trigger:** Use the "Run workflow" button in the Gitea Actions UI (`telegraf-snmp-unifi` workflow only).
diff --git a/telegraf-snmp-unifi/Dockerfile b/telegraf-snmp-unifi/Dockerfile
index 674165c..88e158f 100644
--- a/telegraf-snmp-unifi/Dockerfile
+++ b/telegraf-snmp-unifi/Dockerfile
@@ -1,6 +1,29 @@
-FROM telegraf:latest
+FROM buildpack-deps:bookworm-curl
 LABEL org.opencontainers.image.authors="dockerimage@dresi.wtf"
 
+RUN DEBIAN_FRONTEND=noninteractive apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+      iputils-ping snmp procps lm-sensors libcap2-bin && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN wget -q -O - https://repos.influxdata.com/influxdata-archive_compat.key | \
+    gpg --dearmor > /etc/apt/trusted.gpg.d/influxdata.gpg
+
+ENV TELEGRAF_VERSION=1.39.0
+RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" && \
+    case "${dpkgArch##*-}" in \
+      amd64) ARCH='amd64';; \
+      arm64) ARCH='arm64';; \
+      *)     echo "Unsupported architecture: ${dpkgArch}"; exit 1;; \
+    esac && \
+    wget --no-verbose https://dl.influxdata.com/telegraf/releases/telegraf_${TELEGRAF_VERSION}-1_${ARCH}.deb.asc && \
+    wget --no-verbose https://dl.influxdata.com/telegraf/releases/telegraf_${TELEGRAF_VERSION}-1_${ARCH}.deb && \
+    gpg --batch --verify telegraf_${TELEGRAF_VERSION}-1_${ARCH}.deb.asc telegraf_${TELEGRAF_VERSION}-1_${ARCH}.deb && \
+    dpkg -i telegraf_${TELEGRAF_VERSION}-1_${ARCH}.deb && \
+    rm -f telegraf_${TELEGRAF_VERSION}-1_${ARCH}.deb*
+
 RUN cd /usr/share/snmp/mibs && \
     wget -q https://raw.githubusercontent.com/net-snmp/net-snmp/master/mibs/SNMPv2-SMI.txt \
             https://raw.githubusercontent.com/net-snmp/net-snmp/master/mibs/SNMPv2-TC.txt \
@@ -16,3 +39,8 @@ RUN cd /usr/share/snmp/mibs && \
     wget -q -O UBNT-UniFi-MIB \
       https://raw.githubusercontent.com/librenms/librenms/master/mibs/ubnt/UBNT-UniFi-MIB && \
     echo "mibs +ALL" >> /etc/snmp/snmp.conf
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["telegraf"]
diff --git a/telegraf-snmp-unifi/entrypoint.sh b/telegraf-snmp-unifi/entrypoint.sh
new file mode 100644
index 0000000..8e0fa62
--- /dev/null
+++ b/telegraf-snmp-unifi/entrypoint.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+set -e
+
+if [ "${1:0:1}" = '-' ]; then
+    set -- telegraf "$@"
+fi
+
+if [ $EUID -ne 0 ]; then
+    exec "$@"
+else
+    # Allow telegraf to send ICMP packets and bind to privliged ports
+    setcap cap_net_raw,cap_net_bind_service+ep /usr/bin/telegraf || echo "Failed to set additional capabilities on /usr/bin/telegraf"
+
+    # ensure HOME is set to the telegraf user's home dir
+    export HOME=$(getent passwd telegraf | cut -d : -f 6)
+
+    # honor groups supplied via 'docker run --group-add ...' but drop 'root'
+    # (also removes 'telegraf' since we unconditionally add it and don't want it listed twice)
+    # see https://github.com/influxdata/influxdata-docker/issues/724
+    groups="telegraf"
+    extra_groups="$(id -Gn || true)"
+    for group in $extra_groups; do
+        case "$group" in
+            root | telegraf) ;;
+            *) groups="$groups,$group" ;;
+        esac
+    done
+    exec setpriv --reuid telegraf --regid telegraf --groups "$groups" "$@"
+fi