diff --git a/.cirrus.yml b/.cirrus.yml
index 5010bc94339..1a5d94dcfe5 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -70,7 +70,7 @@ task:
   # For faster CI feedback, immediately schedule the linters
   << : *CREDITS_TEMPLATE
   python_cache:
-    folder: "/tmp/python"
+    folder: "/python_build"
     fingerprint_script: cat .python-version /etc/os-release
   unshallow_script:
     - git fetch --unshallow --no-tags
diff --git a/.python-version b/.python-version
index eee6392d5c7..e29d80998a1 100644
--- a/.python-version
+++ b/.python-version
@@ -1 +1 @@
-3.8.16
+3.8.17
diff --git a/ci/lint/04_install.sh b/ci/lint/04_install.sh
index b3b1c91ee01..148819f468a 100755
--- a/ci/lint/04_install.sh
+++ b/ci/lint/04_install.sh
@@ -13,32 +13,31 @@ ${CI_RETRY_EXE} apt-get update
 # - gpg (used by verify-commits)
 ${CI_RETRY_EXE} apt-get install -y curl xz-utils git gpg
 
-if [ -z "${SKIP_PYTHON_INSTALL}" ]; then
-    PYTHON_PATH=/tmp/python
-    if [ ! -d "${PYTHON_PATH}/bin" ]; then
-      (
-        git clone https://github.com/pyenv/pyenv.git
-        cd pyenv/plugins/python-build || exit 1
-        ./install.sh
-      )
-      # For dependencies see https://github.com/pyenv/pyenv/wiki#suggested-build-environment
-      ${CI_RETRY_EXE} apt-get install -y build-essential libssl-dev zlib1g-dev \
-        libbz2-dev libreadline-dev libsqlite3-dev curl llvm \
-        libncursesw5-dev xz-utils tk-dev libxml2-dev libxmlsec1-dev libffi-dev liblzma-dev \
-        clang
-      env CC=clang python-build "$(cat "${BASE_ROOT_DIR}/.python-version")" "${PYTHON_PATH}"
-    fi
-    export PATH="${PYTHON_PATH}/bin:${PATH}"
-    command -v python3
-    python3 --version
+PYTHON_PATH="/python_build"
+if [ ! -d "${PYTHON_PATH}/bin" ]; then
+  (
+    git clone https://github.com/pyenv/pyenv.git
+    cd pyenv/plugins/python-build || exit 1
+    ./install.sh
+  )
+  # For dependencies see https://github.com/pyenv/pyenv/wiki#suggested-build-environment
+  ${CI_RETRY_EXE} apt-get install -y build-essential libssl-dev zlib1g-dev \
+    libbz2-dev libreadline-dev libsqlite3-dev curl llvm \
+    libncursesw5-dev xz-utils tk-dev libxml2-dev libxmlsec1-dev libffi-dev liblzma-dev \
+    clang
+  env CC=clang python-build "$(cat "./.python-version")" "${PYTHON_PATH}"
 fi
+export PATH="${PYTHON_PATH}/bin:${PATH}"
+command -v python3
+python3 --version
 
-${CI_RETRY_EXE} pip3 install codespell==2.2.5
-${CI_RETRY_EXE} pip3 install flake8==6.0.0
-${CI_RETRY_EXE} pip3 install lief==0.13.2
-${CI_RETRY_EXE} pip3 install mypy==1.4.1
-${CI_RETRY_EXE} pip3 install pyzmq==25.1.0
-${CI_RETRY_EXE} pip3 install vulture==2.6
+${CI_RETRY_EXE} pip3 install \
+  codespell==2.2.5 \
+  flake8==6.0.0 \
+  lief==0.13.2 \
+  mypy==1.4.1 \
+  pyzmq==25.1.0 \
+  vulture==2.6
 
 SHELLCHECK_VERSION=v0.8.0
 curl -sL "https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION}/shellcheck-${SHELLCHECK_VERSION}.linux.x86_64.tar.xz" | \
diff --git a/ci/lint/Dockerfile b/ci/lint/Dockerfile
deleted file mode 100644
index a0a45164803..00000000000
--- a/ci/lint/Dockerfile
+++ /dev/null
@@ -1,29 +0,0 @@
-# See test/lint/README.md for usage.
-#
-# This container basically has to live in this directory in order to pull in the CI
-# install scripts. If it lived in the root directory, it would have to pull in the
-# entire repo as docker context during build; if it lived elsewhere, it wouldn't be
-# able to make back-references to pull in the install scripts. So here it lives.
-
-FROM python:3.8-buster
-
-ENV DEBIAN_FRONTEND=noninteractive
-ENV LC_ALL=C.UTF-8
-
-# This is used by the 04_install.sh script; we can't read the Python version from
-# .python-version for the same reasons as above, and it's more efficient to pull a
-# preexisting Python image than it is to build from source.
-ENV SKIP_PYTHON_INSTALL=1
-
-# Must be built from ./ci/lint/ for these paths to work.
-COPY ./docker-entrypoint.sh /entrypoint.sh
-COPY ./04_install.sh /install.sh
-
-RUN /install.sh && \
-  echo 'alias lint="./ci/lint/06_script.sh"' >> ~/.bashrc && \
-  chmod 755 /entrypoint.sh && \
-  rm -rf /var/lib/apt/lists/*
-
-
-WORKDIR /bitcoin
-ENTRYPOINT ["/entrypoint.sh"]
diff --git a/ci/lint/docker-entrypoint.sh b/ci/lint/docker-entrypoint.sh
index 3fdbbb0761c..63bd2d4298c 100755
--- a/ci/lint/docker-entrypoint.sh
+++ b/ci/lint/docker-entrypoint.sh
@@ -5,6 +5,8 @@ export LC_ALL=C
 # of the mounted bitcoin src dir.
 git config --global --add safe.directory /bitcoin
 
+export PATH="/python_build/bin:${PATH}"
+
 if [ -z "$1" ]; then
   LOCAL_BRANCH=1 bash -ic "./ci/lint/06_script.sh"
 else
diff --git a/ci/lint_imagefile b/ci/lint_imagefile
new file mode 100644
index 00000000000..20047ea3919
--- /dev/null
+++ b/ci/lint_imagefile
@@ -0,0 +1,19 @@
+# See test/lint/README.md for usage.
+
+FROM debian:bookworm
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV LC_ALL=C.UTF-8
+
+COPY ./.python-version /.python-version
+COPY ./ci/lint/docker-entrypoint.sh /entrypoint.sh
+COPY ./ci/lint/04_install.sh /install.sh
+
+RUN /install.sh && \
+  echo 'alias lint="./ci/lint/06_script.sh"' >> ~/.bashrc && \
+  chmod 755 /entrypoint.sh && \
+  rm -rf /var/lib/apt/lists/*
+
+
+WORKDIR /bitcoin
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/test/lint/README.md b/test/lint/README.md
index 704922d7abe..d9cfeb50edb 100644
--- a/test/lint/README.md
+++ b/test/lint/README.md
@@ -7,10 +7,8 @@ To run linters locally with the same versions as the CI environment, use the inc
 Dockerfile:
 
 ```sh
-cd ./ci/lint
-docker build -t bitcoin-linter .
+DOCKER_BUILDKIT=1 docker build -t bitcoin-linter --file "./ci/lint_imagefile" ./
 
-cd /root/of/bitcoin/repo
 docker run --rm -v $(pwd):/bitcoin -it bitcoin-linter
 ```