diff --git a/.env b/.env
index 35dc2f0..2022656 100644
--- a/.env
+++ b/.env
@@ -7,6 +7,7 @@
 # are not set in the shell environment.
 
 # To override these values, set the shell environment variables.
+JUPYTERHUB_VERSION=0.8.0
 
 # Name of Docker machine
 DOCKER_MACHINE_NAME=jupyterhub
@@ -15,7 +16,10 @@ DOCKER_MACHINE_NAME=jupyterhub
 DOCKER_NETWORK_NAME=jupyterhub-network
 
 # Single-user Jupyter Notebook server container image
-DOCKER_NOTEBOOK_IMAGE=jupyter/scipy-notebook:8f56e3c47fec
+DOCKER_NOTEBOOK_IMAGE=jupyter/minimal-notebook:e1677043235c
+
+# the local image we use, after pinning jupyterhub version
+LOCAL_NOTEBOOK_IMAGE=jupyterhub-user
 
 # Notebook directory in the container.
 # This will be /home/jovyan/work if the default
diff --git a/Dockerfile.jupyterhub b/Dockerfile.jupyterhub
index 7b51e8b..dfcf049 100644
--- a/Dockerfile.jupyterhub
+++ b/Dockerfile.jupyterhub
@@ -1,13 +1,14 @@
 # Copyright (c) Jupyter Development Team.
 # Distributed under the terms of the Modified BSD License.
-FROM jupyterhub/jupyterhub-onbuild:0.7.2
+ARG JUPYTERHUB_VERSION
+FROM jupyterhub/jupyterhub-onbuild:$JUPYTERHUB_VERSION
 
 # Install dockerspawner, oauth, postgres
-RUN /opt/conda/bin/conda install psycopg2=2.7 && \
+RUN /opt/conda/bin/conda install -yq psycopg2=2.7 && \
     /opt/conda/bin/conda clean -tipsy && \
-    /opt/conda/bin/pip install \
-    oauthenticator==0.6.* \
-    dockerspawner==0.8.*
+    /opt/conda/bin/pip install --no-cache-dir \
+        oauthenticator==0.7.* \
+        dockerspawner==0.9.*
 
 # Copy TLS certificate and key
 ENV SSL_CERT /srv/jupyterhub/secrets/jupyterhub.crt
diff --git a/Makefile b/Makefile
index f608836..e0932e3 100644
--- a/Makefile
+++ b/Makefile
@@ -50,7 +50,11 @@ check-files: userlist $(cert_files) secrets/oauth.env secrets/postgres.env
 pull:
 	docker pull $(DOCKER_NOTEBOOK_IMAGE)
 
-notebook_image: pull
+notebook_image: pull singleuser/Dockerfile
+	docker build -t $(LOCAL_NOTEBOOK_IMAGE) \
+		--build-arg JUPYTERHUB_VERSION=$(JUPYTERHUB_VERSION) \
+		--build-arg DOCKER_NOTEBOOK_IMAGE=$(DOCKER_NOTEBOOK_IMAGE) \
+		singleuser
 
 build: check-files network volumes
 	docker-compose build
diff --git a/docker-compose.yml b/docker-compose.yml
index 7c3e7d1..ffb3069 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -23,6 +23,8 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.jupyterhub
+      args:
+        JUPYTERHUB_VERSION: ${JUPYTERHUB_VERSION}
     restart: always
     image: jupyterhub
     container_name: jupyterhub
@@ -40,7 +42,7 @@ services:
       # All containers will join this network
       DOCKER_NETWORK_NAME: ${DOCKER_NETWORK_NAME}
       # JupyterHub will spawn this Notebook image for users
-      DOCKER_NOTEBOOK_IMAGE: ${DOCKER_NOTEBOOK_IMAGE}
+      DOCKER_NOTEBOOK_IMAGE: ${LOCAL_NOTEBOOK_IMAGE}
       # Notebook directory inside user image
       DOCKER_NOTEBOOK_DIR: ${DOCKER_NOTEBOOK_DIR}
       # Using this run command (optional)
diff --git a/singleuser/Dockerfile b/singleuser/Dockerfile
new file mode 100644
index 0000000..79cb44e
--- /dev/null
+++ b/singleuser/Dockerfile
@@ -0,0 +1,4 @@
+ARG DOCKER_NOTEBOOK_IMAGE
+FROM $DOCKER_NOTEBOOK_IMAGE
+ARG JUPYTERHUB_VERSION
+RUN python3 -m pip install --no-cache jupyterhub==$JUPYTERHUB_VERSION