diff --git a/.circleci/config.yml b/.circleci/config.yml
index fb273a20..f1fb701f 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -52,6 +52,35 @@ jobs:
           command: |
             docker push ocrd/all:<< parameters.variant >>
             docker push ocrd/all:<< parameters.variant >>-git
+      - when:
+          condition:
+            equal: [ maximum, << parameters.variant >> ]
+          steps:
+            - run:
+                name: Alias and push intermediate variants
+                command: |
+                  docker tag ocrd/all:medium ocrd/all:medium-git
+                  docker tag ocrd/all:minimum ocrd/all:minimum-git
+                  docker push ocrd/all:minimum
+                  docker push ocrd/all:minimum-git
+                  docker push ocrd/all:medium
+                  docker push ocrd/all:medium-git
+            - run:
+                name: store ocrd-all-tool.json
+                command: |
+                  id=`docker create ocrd/all:maximum`
+                  docker cp $id:/build/ocrd-all-tool.json .
+            - store_artifacts:
+                path: ocrd-all-tool.json
+                destination: ocrd-all-tool.json
+            - run:
+                name: store ocrd-all-module-dir.json
+                command: |
+                  id=`docker create ocrd/all:maximum`
+                  docker cp $id:/build/ocrd-all-module-dir.json .
+            - store_artifacts:
+                path: ocrd-all-module-dir.json
+                destination: ocrd-all-module-dir.json
       - when:
           condition:
             equal: [ maximum-cuda, << parameters.variant >> ]
@@ -69,7 +98,7 @@ workflows:
       - deploy:
           matrix:
             parameters:
-              variant: [minimum, medium, maximum, maximum-cuda]
+              variant: [maximum, maximum-cuda]
           filters:
             branches:
               only: master
diff --git a/.github/workflows/makedocker.yml b/.github/workflows/makedocker.yml
index 0d6b3e86..3a94b8ae 100644
--- a/.github/workflows/makedocker.yml
+++ b/.github/workflows/makedocker.yml
@@ -46,7 +46,6 @@ jobs:
            df -h
            docker images
            docker rmi $(docker images --filter=reference="alpine:*" -q)
-           docker rmi $(docker images --filter=reference="buildpack-deps:*" -q)
            docker rmi $(docker images --filter=reference="debian:*" -q)
            docker rmi $(docker images --filter=reference="node:*" -q)
            df -h /
diff --git a/Makefile b/Makefile
index 9f2cbaa9..b848046c 100644
--- a/Makefile
+++ b/Makefile
@@ -76,11 +76,17 @@ ifneq ($(PYTHON_VERSION),3.8)
 DEFAULT_DISABLED_MODULES += cor-asv-ann ocrd_keraslm
 endif
 endif
+ifeq ($(PYTHON_VERSION),3.11)
+# Detectron2 relies on Pytorch 1 which still uses pkg_resources
+DEFAULT_DISABLED_MODULES += ocrd_detectron2
+endif
 ifeq ($(PYTHON_VERSION),3.12)
 # The required tensorflow is not available for Python 3.12.
 DEFAULT_DISABLED_MODULES += eynollah ocrd_anybaseocr ocrd_calamari sbb_binarization
 # The required coremltools does not support Python 3.12.
 DEFAULT_DISABLED_MODULES += ocrd_kraken
+# Detectron2 relies on Pytorch 1 which still uses pkg_resources
+DEFAULT_DISABLED_MODULES += ocrd_detectron2
 endif
 ifeq ($(shell uname -s),Darwin)
 # Disable ocrd_olena for macOS because build is broken.
@@ -276,8 +282,16 @@ OCRD_KRAKEN := $(BIN)/ocrd-kraken-binarize
 OCRD_KRAKEN += $(BIN)/ocrd-kraken-segment
 OCRD_KRAKEN += $(BIN)/ocrd-kraken-recognize
 $(call multirule,$(OCRD_KRAKEN)): ocrd_kraken $(BIN)/ocrd
+# now needs to be in sub-venv because shapely<2 clashes with shapely>=2 in other modules
+ifeq (0,$(MAKELEVEL))
+	$(MAKE) -o $< $(notdir $(OCRD_KRAKEN)) VIRTUAL_ENV=$(SUB_VENV_TF1)
+	$(call delegate_venv,$(OCRD_KRAKEN),$(SUB_VENV_TF1))
+ocrd_kraken-check:
+	$(MAKE) check OCRD_MODULES=ocrd_kraken VIRTUAL_ENV=$(SUB_VENV_TF1)
+else
 	$(pip_install)
 endif
+endif
 
 ifneq ($(filter ocrd_detectron2, $(OCRD_MODULES)),)
 # ocrd_detectron patches detectron2 until there is a new detectron2 release.
@@ -441,16 +455,8 @@ OCRD_SEGMENT += $(BIN)/ocrd-segment-replace-text
 OCRD_SEGMENT += $(BIN)/ocrd-segment-repair
 OCRD_SEGMENT += $(BIN)/ocrd-segment-project
 $(call multirule,$(OCRD_SEGMENT)): ocrd_segment $(BIN)/ocrd
-ifeq (0,$(MAKELEVEL))
-	$(MAKE) -o $< $(notdir $(OCRD_SEGMENT)) VIRTUAL_ENV=$(SUB_VENV_TF1)
-	$(call delegate_venv,$(OCRD_SEGMENT),$(SUB_VENV_TF1))
-ocrd_segment-check:
-	$(MAKE) check OCRD_MODULES=ocrd_segment VIRTUAL_ENV=$(SUB_VENV_TF1)
-else
-	$(pip_install_tf1nvidia)
 	$(pip_install)
 endif
-endif
 
 ifneq ($(filter ocrd_tesserocr, $(OCRD_MODULES)),)
 ocrd_tesserocr: GIT_RECURSIVE = --recursive
@@ -832,6 +838,7 @@ fix-cuda: $(ACTIVATE_VENV)
 
 # Docker builds.
 DOCKER_TAG ?= ocrd/all
+DOCKER_BASE_IMAGE ?= ocrd/core:$(CORE_VERSION)
 
 # Several predefined selections
 # (note: to arrive at smallest possible image size individually,
@@ -845,16 +852,25 @@ dockers: docker-minimum docker-minimum-cuda docker-medium docker-medium-cuda doc
 docker-%: PIP_OPTIONS = -e
 
 # Minimum-size selection: use Ocropy binarization, use Tesseract from git
-docker-mini%: DOCKER_MODULES := core ocrd_cis ocrd_fileformat ocrd_im6convert ocrd_pagetopdf ocrd_repair_inconsistencies ocrd_tesserocr ocrd_wrap workflow-configuration ocrd_olahd_client
+docker-mini%: DOCKER_MODULES := ocrd_cis ocrd_fileformat ocrd_im6convert ocrd_pagetopdf ocrd_repair_inconsistencies ocrd_tesserocr ocrd_wrap workflow-configuration ocrd_olahd_client
 # Medium-size selection: add Olena binarization and Calamari, add evaluation
-docker-medi%: DOCKER_MODULES := core cor-asv-ann dinglehopper docstruct format-converters nmalign ocrd_calamari ocrd_cis ocrd_fileformat ocrd_im6convert ocrd_keraslm ocrd_olahd_client ocrd_olena ocrd_pagetopdf ocrd_repair_inconsistencies ocrd_segment ocrd_tesserocr ocrd_wrap workflow-configuration
+docker-medi%: DOCKER_MODULES := cor-asv-ann dinglehopper docstruct format-converters nmalign ocrd_calamari ocrd_cis ocrd_fileformat ocrd_im6convert ocrd_keraslm ocrd_olahd_client ocrd_olena ocrd_pagetopdf ocrd_repair_inconsistencies ocrd_segment ocrd_tesserocr ocrd_wrap workflow-configuration
 # Maximum-size selection: use all modules
 docker-maxi%: DOCKER_MODULES := $(OCRD_MODULES)
 
 # DOCKER_BASE_IMAGE
-docker-%um: DOCKER_BASE_IMAGE = docker.io/ocrd/core:$(CORE_VERSION)
+docker-minimum: DOCKER_BASE_IMAGE = ocrd/core:$(CORE_VERSION)
+docker-medium: DOCKER_BASE_IMAGE = $(DOCKER_TAG):minimum
+docker-maximum: DOCKER_BASE_IMAGE = $(DOCKER_TAG):medium
 # CUDA variants
-docker-%-cuda: DOCKER_BASE_IMAGE = docker.io/ocrd/core-cuda:$(CORE_VERSION)
+docker-minimum-cuda: DOCKER_BASE_IMAGE = ocrd/core-cuda:$(CORE_VERSION)
+docker-medium-cuda: DOCKER_BASE_IMAGE = $(DOCKER_TAG):minimum-cuda
+docker-maximum-cuda: DOCKER_BASE_IMAGE = $(DOCKER_TAG):medium-cuda
+# explicit interdependencies
+docker-medium: docker-minimum
+docker-maximum: docker-medium
+docker-medium-cuda: docker-minimum-cuda
+docker-maximum-cuda: docker-medium-cuda
 
 # Build rule for all selections
 # FIXME: $(DOCKER_MODULES) ref does not work at phase 1; workaround: all modules
diff --git a/core b/core
index c5b5580b..cc6ea575 160000
--- a/core
+++ b/core
@@ -1 +1 @@
-Subproject commit c5b5580ba5c517e6ee151a5b3a1d8fe1b3ba0d88
+Subproject commit cc6ea575f18cb89732d9a19ab12544ffe539fde3
diff --git a/dinglehopper b/dinglehopper
index f8e31089..bc5818da 160000
--- a/dinglehopper
+++ b/dinglehopper
@@ -1 +1 @@
-Subproject commit f8e31089b3e7f8db7d5ef8648aa99015b3fba45c
+Subproject commit bc5818da9f9d0ae44fcc7580ed458eb8a900be89
diff --git a/ocrd_anybaseocr b/ocrd_anybaseocr
index eb6ea8ea..3459b419 160000
--- a/ocrd_anybaseocr
+++ b/ocrd_anybaseocr
@@ -1 +1 @@
-Subproject commit eb6ea8ea62c6577a1a126413e09bf1bbbec2a833
+Subproject commit 3459b41989589f4767c958ca354d4c2cba7604ad
diff --git a/ocrd_cis b/ocrd_cis
index 1d2e858d..6e95b384 160000
--- a/ocrd_cis
+++ b/ocrd_cis
@@ -1 +1 @@
-Subproject commit 1d2e858d2bb2a5f1d64bf761b81b4173946781b9
+Subproject commit 6e95b3847ec5532c039062062129ce3c1c1a6bf7
diff --git a/ocrd_detectron2 b/ocrd_detectron2
index a8402d8e..1f56273d 160000
--- a/ocrd_detectron2
+++ b/ocrd_detectron2
@@ -1 +1 @@
-Subproject commit a8402d8e58570fdefb80bdf44cfc4aea8f914d4c
+Subproject commit 1f56273d08fe098ac8b3f606c0a19927f8425225
diff --git a/ocrd_fileformat b/ocrd_fileformat
index ba79de91..899a7cf2 160000
--- a/ocrd_fileformat
+++ b/ocrd_fileformat
@@ -1 +1 @@
-Subproject commit ba79de915577107c0a2d1a89f74b5f65f730dc70
+Subproject commit 899a7cf2f857696a99ebc0a70816ca1132af6520
diff --git a/ocrd_froc b/ocrd_froc
index 45d5dcde..42f1ce0e 160000
--- a/ocrd_froc
+++ b/ocrd_froc
@@ -1 +1 @@
-Subproject commit 45d5dcdefe156becb74c100faa7f722966936d3a
+Subproject commit 42f1ce0e369d22948f330148035ff02f9866b806
diff --git a/ocrd_keraslm b/ocrd_keraslm
index 472197f8..ea79b2ab 160000
--- a/ocrd_keraslm
+++ b/ocrd_keraslm
@@ -1 +1 @@
-Subproject commit 472197f8f6bbbba0c55d14da5786657cd2e98322
+Subproject commit ea79b2ab495c1d7ab3db678be27c89965b76e3b0
diff --git a/ocrd_segment b/ocrd_segment
index 39931391..de824e9d 160000
--- a/ocrd_segment
+++ b/ocrd_segment
@@ -1 +1 @@
-Subproject commit 3993139175ed986aa4c3f4e914d028340c6004d3
+Subproject commit de824e9d5bb9a56ac253b7c6dd7d7c012cdddc64
diff --git a/ocrd_tesserocr b/ocrd_tesserocr
index ed73d966..75a782da 160000
--- a/ocrd_tesserocr
+++ b/ocrd_tesserocr
@@ -1 +1 @@
-Subproject commit ed73d9665258e2a2a05c9589d27697bc1beaa065
+Subproject commit 75a782dacb3195313a5628ccb9eb024d43240bfc
diff --git a/sbb_binarization b/sbb_binarization
index b89ec490..978f425b 160000
--- a/sbb_binarization
+++ b/sbb_binarization
@@ -1 +1 @@
-Subproject commit b89ec490befc56f7b471307561c84dc56a609054
+Subproject commit 978f425bd154458e92888d2a974fe759bb3a5c06
diff --git a/workflow-configuration b/workflow-configuration
index bd149f83..e39fdafd 160000
--- a/workflow-configuration
+++ b/workflow-configuration
@@ -1 +1 @@
-Subproject commit bd149f831a6bc5227e2b17f623c33221f307ff78
+Subproject commit e39fdafda3cb5923e2c892390b7b345dd554ec36