diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 56cf410e3..73a883d8a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -11,7 +11,7 @@ jobs:
   enforce-g_malloc:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         # Clone the whole branch, we have to fetch tags later
         fetch-depth: 0
@@ -21,6 +21,7 @@ jobs:
 
   build:
     strategy:
+      fail-fast: false
       matrix:
         CC:
           - clang
@@ -28,34 +29,28 @@ jobs:
         distro:
           - alpine
           - archlinux
-          - debian-stretch
+          - debian-bookworm
+          - debian-bullseye
           - debian-buster
           - fedora
-          - ubuntu-xenial
-          - ubuntu-bionic
           - ubuntu-focal
+          - ubuntu-jammy
 
     env:
       CC: ${{ matrix.CC }}
-      EXTRA_CFLAGS: "-Werror"
+      EXTRA_CFLAGS: "-Werror ${{ (matrix.distro == 'debian-bookworm' || matrix.distro == 'ubuntu-jammy') && matrix.CC == 'clang' && '-gdwarf-4' || ' '}}"
+
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
-        # Clone the whole branch, we have to fetch tags later
+        # Clone the whole history including tags.
         fetch-depth: 0
 
-    # Fetch tags to determine proper version number inside git
-    - name: fetch tags
-      run: git fetch --tags
-      # We cannot pull tags with old distros, since there is no `.git`. See below.
-      if: "! (matrix.distro == 'ubuntu-bionic' || matrix.distro == 'ubuntu-xenial' || matrix.distro == 'debian-stretch')"
+    - name: setup $HOME for git
+      run: echo "HOME=${RUNNER_TEMP}" >> ${GITHUB_ENV}
 
-    # The Github checkout Action doesn't support distros with git older than 2.18
-    # With git<2.18 it downloads the code via API and does not clone it via git :facepalm:
-    # To succeed the tests, we have to manually replace the VERSION macro
-    - name: fix version number for old distros
-      run: 'sed -i "s/-non-git/-ci-oldgit-$GITHUB_SHA/" Makefile'
-      if: "  (matrix.distro == 'ubuntu-bionic' || matrix.distro == 'ubuntu-xenial' || matrix.distro == 'debian-stretch')"
+    - name: configure safe directory for git
+      run: git config --global --add safe.directory ${GITHUB_WORKSPACE}
 
     - name: build
       run: make -j all dunstify test/test
@@ -67,21 +62,17 @@ jobs:
       run: ./test/test-install.sh
 
     - name: valgrind memleaks
-      run: |
-        make clean
-        make -j test-valgrind
+      run: make -j clean test-valgrind
 
     - name: coverage
-      run: |
-        make clean
-        make -j test-coverage
+      run: make clean test-coverage
 
     - name: Generate coverage report
       run: lcov -c -d . -o lcov.info
       if: "matrix.CC == 'gcc'"
 
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v1
+      uses: codecov/codecov-action@v3
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         flags: unittests
@@ -91,23 +82,15 @@ jobs:
 
     runs-on: ubuntu-latest
     container:
-      image: dunst/ci:${{ matrix.distro }}
+      image: ghcr.io/dunst-project/docker-images:${{ matrix.distro }}
 
   doxygen:
-    strategy:
-      matrix:
-        distro:
-          - misc-doxygen
-
     steps:
-    - uses: actions/checkout@v2
-      with:
-        # Clone the whole branch, we have to fetch tags later
-        fetch-depth: 0
+    - uses: actions/checkout@v4
 
     - name: doxygen
       run: make -j doc-doxygen
 
     runs-on: ubuntu-latest
     container:
-      image: dunst/ci:${{ matrix.distro }}
+      image: ghcr.io/dunst-project/docker-images:misc-doxygen
diff --git a/.valgrind.suppressions b/.valgrind.suppressions
index a18fc67c1..784d3b32f 100644
--- a/.valgrind.suppressions
+++ b/.valgrind.suppressions
@@ -135,3 +135,45 @@
    obj:*pango*
    ...
 }
+
+{
+   rsvg_conditional_jump
+   Memcheck:Cond
+   obj:/usr/lib*/librsvg-2.so.2.48.0
+   ...
+   fun:rsvg_handle_get_pixbuf
+   obj:/usr/lib*/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-svg.so
+   obj:/usr/lib*/libgdk_pixbuf-2.0.so.0.4200.10
+   fun:gdk_pixbuf_new_from_file
+   fun:notification_setup_raw_image
+   fun:notification_load_icon_with_scaling
+   ...
+}
+{
+   # Basically the same as above, but just for Debian
+   rsvg_conditional_jump-debian
+   Memcheck:Cond
+   obj:/usr/lib/*/librsvg-2.so.2.48.0
+   ...
+   fun:rsvg_handle_get_pixbuf
+   obj:/usr/lib/*/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-svg.so
+   obj:/usr/lib/*/libgdk_pixbuf-2.0.so.0.4200.8
+   fun:gdk_pixbuf_new_from_file
+   fun:notification_setup_raw_image
+   fun:notification_load_icon_with_scaling
+   ...
+}
+{
+   # Basically the same as above, but just for Ubuntu Focal
+   rsvg_conditional_jump-ubuntu_focal
+   Memcheck:Cond
+   obj:/usr/lib/*/librsvg-2.so.2.47.0
+   ...
+   fun:rsvg_rust_handle_close
+   obj:/usr/lib/*/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-svg.so
+   obj:/usr/lib/*/libgdk_pixbuf-2.0.so.0.4000.0
+   fun:gdk_pixbuf_new_from_file
+   fun:notification_setup_raw_image
+   fun:notification_load_icon_with_scaling
+   ...
+}