diff --git a/README.md b/README.md
index 2dc03cb..d733e50 100644
--- a/README.md
+++ b/README.md
@@ -12,13 +12,15 @@ Images are built from current CAs fetched at build/CI time from [http://pki.atla
 | `git.atlashorizon.net/atlashorizon/container-base/debian-slim:trixie` | `debian:trixie-slim` |
 | `git.atlashorizon.net/atlashorizon/container-base/ubuntu:24.04` | `ubuntu:24.04` |
 | `git.atlashorizon.net/atlashorizon/container-base/alpine:3.24` | `alpine:3.24` |
+| `git.atlashorizon.net/atlashorizon/container-base/python:3.12-slim-bookworm` | `python:3.12-slim-bookworm` |
 
-On `main`, each family also gets a `:latest` tag (`debian:latest`, `debian-slim:latest`, `ubuntu:latest`, `alpine:latest`).
+On `main`, each family also gets a `:latest` tag (`debian:latest`, `debian-slim:latest`, `ubuntu:latest`, `alpine:latest`, `python:latest`).
 
 ```dockerfile
 FROM git.atlashorizon.net/atlashorizon/container-base/debian-slim:trixie
 FROM git.atlashorizon.net/atlashorizon/container-base/ubuntu:24.04
 FROM git.atlashorizon.net/atlashorizon/container-base/alpine:3.24
+FROM git.atlashorizon.net/atlashorizon/container-base/python:3.12-slim-bookworm
 ```
 
 ## Certificates
@@ -42,7 +44,7 @@ Requires `curl` and `openssl`.
 
 ## Gitea Actions and registry
 
-[`.gitea/workflows/container.yml`](.gitea/workflows/container.yml) fetches the CAs, builds all four images with Bake, and publishes to this Gitea instance’s OCI registry.
+[`.gitea/workflows/container.yml`](.gitea/workflows/container.yml) fetches the CAs, builds all five images with Bake, and publishes to this Gitea instance’s OCI registry.
 
 On `main`, version tags (`v*`), and manual **Run workflow**:
 
@@ -53,7 +55,7 @@ git.atlashorizon.net/atlashorizon/container-base/debian:sha-<short-sha>
 git.atlashorizon.net/atlashorizon/container-base/debian:manual   # workflow_dispatch
 ```
 
-(and the same tag set for `debian-slim`, `ubuntu`, `alpine`).
+(and the same tag set for `debian-slim`, `ubuntu`, `alpine`, `python`).
 
 The host is taken from the Actions server URL (or `vars.REGISTRY` if you set one). The image prefix is `{registry}/{owner}/{repo}` in lowercase, which is what [Gitea’s container registry](https://docs.gitea.com/usage/packages/container) requires.
 
diff --git a/docker-bake.hcl b/docker-bake.hcl
index b55d499..6077fdd 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -25,7 +25,7 @@ function "image_tags" {
 }
 
 group "default" {
-  targets = ["debian", "debian-slim", "ubuntu", "alpine"]
+  targets = ["debian", "debian-slim", "ubuntu", "alpine", "python"]
 }
 
 target "debian" {
@@ -59,3 +59,11 @@ target "alpine" {
   }
   tags = image_tags("alpine", "3.24")
 }
+
+target "python" {
+  dockerfile = "Dockerfile"
+  args = {
+    BASE_IMAGE = "python:3.12-slim-bookworm"
+  }
+  tags = image_tags("python", "3.12-slim-bookworm")
+}