diff --git a/Dockerfile b/Dockerfile
index c7d984a..d7a2988 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.23
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.24
 
 # set version label
 ARG BUILD_DATE
diff --git a/Dockerfile.aarch64 b/Dockerfile.aarch64
index a5f0a53..184f2f7 100644
--- a/Dockerfile.aarch64
+++ b/Dockerfile.aarch64
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.23
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.24
 
 # set version label
 ARG BUILD_DATE
diff --git a/README.md b/README.md
index 3544ccf..08136d6 100644
--- a/README.md
+++ b/README.md
@@ -107,7 +107,9 @@ services:
       - PUID=1000
       - PGID=1000
       - TZ=Etc/UTC
+      - APP_SECRET=
       - DATABASE_URL=mysql://your_db_user:your_db_pass@your_db_host:3306/your_db_name?charset=your_db_charset&serverVersion=your_db_version
+      - TRUSTED_HOSTS=kimai.example.com
       - TRUSTED_PROXIES=127.0.0.1/32 #optional
     volumes:
       - /path/to/kimai/config:/config
@@ -145,7 +147,9 @@ docker run -d \
   -e PUID=1000 \
   -e PGID=1000 \
   -e TZ=Etc/UTC \
+  -e APP_SECRET= \
   -e DATABASE_URL=mysql://your_db_user:your_db_pass@your_db_host:3306/your_db_name?charset=your_db_charset&serverVersion=your_db_version \
+  -e TRUSTED_HOSTS=kimai.example.com \
   -e TRUSTED_PROXIES=127.0.0.1/32 `#optional` \
   -p 80:80 \
   -p 443:443 \
@@ -181,7 +185,9 @@ Containers are configured using parameters passed at runtime (such as those abov
 | `-e PUID=1000` | for UserID - see below for explanation |
 | `-e PGID=1000` | for GroupID - see below for explanation |
 | `-e TZ=Etc/UTC` | specify a timezone to use, see this [list](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List). |
+| `-e APP_SECRET=` | Random string used for session encryption. Generate using e.g. `openssl rand -hex 32`. |
 | `-e DATABASE_URL=mysql://your_db_user:your_db_pass@your_db_host:3306/your_db_name?charset=your_db_charset&serverVersion=your_db_version` | Configure your database connection, see Application Setup instructions. |
+| `-e TRUSTED_HOSTS=kimai.example.com` | Domain or IP you will be using to access Kimai. Can be a regex like `localhost|127.0.0.1|kimai.example.com` |
 | `-e TRUSTED_PROXIES=127.0.0.1/32` | If behind a reverse proxy set this to its IP or network CIDR so that Kimai trusts its headers. |
 | `-v /config` | Persistent config files |
 
@@ -347,6 +353,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **04.07.27:** - Rebase to Alpine 3.24.
 * **28.12.25:** - Rebase to Alpine 3.23.
 * **04.07.25:** - Rebase to Alpine 3.22.
 * **06.04.25:** - Rebase to Alpine 3.21.
diff --git a/readme-vars.yml b/readme-vars.yml
index 67f5372..4bc98a5 100644
--- a/readme-vars.yml
+++ b/readme-vars.yml
@@ -22,7 +22,9 @@ common_param_env_vars_enabled: true
 param_container_name: "{{ project_name }}"
 param_usage_include_env: true
 param_env_vars:
+  - {env_var: "APP_SECRET", env_value: "", desc: "Random string used for session encryption. Generate using e.g. `openssl rand -hex 32`."}
   - {env_var: "DATABASE_URL", env_value: "mysql://your_db_user:your_db_pass@your_db_host:3306/your_db_name?charset=your_db_charset&serverVersion=your_db_version", desc: "Configure your database connection, see Application Setup instructions."}
+  - {env_var: "TRUSTED_HOSTS", env_value: "kimai.example.com", desc: "Domain or IP you will be using to access Kimai. Can be a regex like `localhost|127.0.0.1|kimai.example.com`"}
 opt_param_usage_include_env: true
 opt_param_env_vars:
   - {env_var: "TRUSTED_PROXIES", env_value: "127.0.0.1/32", desc: "If behind a reverse proxy set this to its IP or network CIDR so that Kimai trusts its headers."}
@@ -157,6 +159,7 @@ init_diagram: |
   "kimai:latest" <- Base Images
 # changelog
 changelogs:
+  - {date: "04.07.27:", desc: "Rebase to Alpine 3.24."}
   - {date: "28.12.25:", desc: "Rebase to Alpine 3.23."}
   - {date: "04.07.25:", desc: "Rebase to Alpine 3.22."}
   - {date: "06.04.25:", desc: "Rebase to Alpine 3.21."}