diff --git a/Dockerfile b/Dockerfile
index 207ce55a47e483e19e3907052948ce33784e6868..cb5ffe647b9b6ab88d2430d18ae4f8550d7503bf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,10 @@
 ARG BASE_REGISTRY=nexus-docker-secure.levelup-dev.io
 ARG BASE_IMAGE=redhat/openjdk/openjdk8
-ARG BASE_TAG=latest
+ARG BASE_TAG=1.8.0
 FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
 
+USER root
+
 ARG user=jenkins
 ARG group=jenkins
 ARG uid=1000
@@ -21,8 +23,6 @@ RUN dnf update -y --nodocs && \
     dnf -y clean all
 # TODO https://github.com/git-lfs/git-lfs/wiki/Installation#rhelcentos → ius.io / https://packagecloud.io/github/git-lfs/install#bash-rpm
 
-VOLUME /home/${user}/.jenkins
-VOLUME ${AGENT_WORKDIR}
 WORKDIR /home/${user}
 
 ENTRYPOINT ["entrypoint", "jenkins-agent"]
@@ -40,7 +40,10 @@ RUN chmod 755 /usr/share/jenkins && \
     chmod 644 /usr/share/jenkins/agent.jar && \
     chmod a+x /usr/local/bin/* && \
     chmod ug-s /usr/libexec/openssh/ssh-keysign && \
-    mkdir -p ${AGENT_WORKDIR} && \
+    mkdir -p ${AGENT_WORKDIR} .jenkins && \
     chown -R ${user}:0 /home/${user} && \
-    chmod g+rwx /home/${user}
+    chmod g+rwx . ${AGENT_WORKDIR} .jenkins
 USER ${uid}
+
+VOLUME /home/${user}/.jenkins
+VOLUME ${AGENT_WORKDIR}
diff --git a/Jenkinsfile b/Jenkinsfile
index 097b7cd3235cacb774cd74ae065867ce68f1e555..e8d2f6e71a7d1f69d8d48ad233d34800e594c435 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -1,2 +1,2 @@
 @Library('DCCSCR@master') _
-dccscrPipeline(version: '2.222.4.3')
+dccscrPipeline(version: '2.235.2.3')
diff --git a/README.md b/README.md
index 27e8f1c7207f2de1fcb827b47bd03fdb5654913d..33066bbcc3ab50fab356dd3edc2f72d3912ee3bd 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@ CloudBees Core consists of three Docker images installed via Helm chart:
 For each image, all files other than UBI and native packages
 are included in a `files.tar` marked with a SHA-256 checksum.
 
-A version of Core is given in the format `2.222.4.3`
+A version of Core is given in the format `2.235.2.3`
 where the first three components are aligned with a Jenkins LTS.
 The Helm chart is coversioned with `core-oc`.
 The `core-mm` image typically shares the same version,
@@ -22,13 +22,13 @@ plus whatever other customizations are desired:
 ```yaml
 OperationsCenter:
   Image:
-    dockerImage: your-registry/core-oc:2.222.4.3
+    dockerImage: your-registry/core-oc:2.235.2.3
 Master:
   Image:
-    dockerImage: your-registry/core-mm:2.222.4.3
+    dockerImage: your-registry/core-mm:2.235.2.3
 Agents:
   Image:
-    dockerImage: your-registry/agent:2.222.4.3
+    dockerImage: your-registry/agent:2.235.2.3
 ```
 
 and [install via Helm 3](https://docs.cloudbees.com/docs/cloudbees-core/latest/kubernetes-install-guide/installing-kubernetes-using-helm) using the local copy of the chart:
diff --git a/download.json b/download.json
index 726173f2684b0d5191a422c052c3e3e314911112..d8892d8422d784473848b9160db71f8bb4659adb 100644
--- a/download.json
+++ b/download.json
@@ -1,11 +1,11 @@
 {
   "resources": [
     {
-      "url": "https://dsop.s3.amazonaws.com/agent-files-254ca1800193cd3e909f60400a0a5cfdd36890b5d70f7df0b8e261e9e8138bbb.tar",
+      "url": "https://dsop.s3.amazonaws.com/agent-files-1f33d6d660d81ff4d28c0d9e9e77020e18b07b770f34ee26ff95c5b82b03efd4.tar",
       "filename": "files.tar",
       "validation": {
         "type": "sha256",
-        "value": "254ca1800193cd3e909f60400a0a5cfdd36890b5d70f7df0b8e261e9e8138bbb"
+        "value": "1f33d6d660d81ff4d28c0d9e9e77020e18b07b770f34ee26ff95c5b82b03efd4"
       }
     }
   ]