diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..88d148366
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,15 @@
+version: 2
+updates:
+  # bump the ziti CLI version that is built into the zrok CLI image
+  - package-ecosystem: docker
+    directory: "/docker/images/zrok"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 20
+    groups:
+      all:
+        applies-to: version-updates
+        update-types:
+          - "major"
+          - "minor"
+          - "patch"
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8b6302828..da06f3a8e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,9 +2,11 @@
 
 ## v0.4.35
 
+FEATURE: Closed permission mode for Docker and Linux private shares
+
 CHANGE: add example in ./etc/caddy to set X-Real-IP header to public share client IP
 
-FEATURE: Closed permission mode for Docker and Linux private shares
+CHANGE: auto-update the ziti CLI version that is built in to the openziti/zrok container image
 
 CHANGE: Docker examples set HOME to enable running CLI commands in the container
 
diff --git a/docker/images/zrok/Dockerfile b/docker/images/zrok/Dockerfile
index 0c2576c9e..983be7075 100644
--- a/docker/images/zrok/Dockerfile
+++ b/docker/images/zrok/Dockerfile
@@ -1,8 +1,5 @@
 # this builds docker.io/openziti/zrok
-ARG ZITI_CLI_TAG="1.0.0"
-ARG ZITI_CLI_IMAGE="docker.io/openziti/ziti-cli"
-
-FROM ${ZITI_CLI_IMAGE}:${ZITI_CLI_TAG}
+FROM docker.io/openziti/ziti-cli:1.1.4
 
 ARG ARTIFACTS_DIR=./dist
 ARG DOCKER_BUILD_DIR=.
@@ -16,7 +13,9 @@ LABEL name="openziti/zrok" \
       maintainer="support@zrok.io" \
       vendor="NetFoundry" \
       summary="Run the zrok CLI" \
-      description="Run the zrok CLI"
+      description="Run the zrok CLI" \
+      org.opencontainers.image.description="Run the zrok CLI" \
+      org.opencontainers.image.source="https://github.com/openziti/zrok"
 
 USER root