diff --git a/.drone.yml b/.drone.yml
index 85a6a50..8f7900b 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -10,7 +10,7 @@ platform:
 steps:
 - name: build
   pull: always
-  image: rancher/hardened-build-base:v1.15.2b5
+  image: rancher/hardened-build-base:v1.15.8b5
   commands:
   - make DRONE_TAG=${DRONE_TAG}
   volumes:
@@ -18,7 +18,7 @@ steps:
     path: /var/run/docker.sock
 
 - name: publish
-  image: rancher/hardened-build-base:v1.15.2b5
+  image: rancher/hardened-build-base:v1.15.8b5
   commands:
   - docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
   - make DRONE_TAG=${DRONE_TAG} image-push image-manifest
@@ -35,7 +35,7 @@ steps:
     - tag
 
 - name: scan
-  image: rancher/hardened-build-base:v1.15.2b5
+  image: rancher/hardened-build-base:v1.15.8b5
   commands:
   - make DRONE_TAG=${DRONE_TAG} image-scan
   volumes:
diff --git a/Dockerfile b/Dockerfile
index 810fdfb..efdef81 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 ARG UBI_IMAGE=registry.access.redhat.com/ubi7/ubi-minimal:latest
-ARG GO_IMAGE=rancher/hardened-build-base:v1.15.2b5
+ARG GO_IMAGE=rancher/hardened-build-base:v1.15.8b5
 FROM ${UBI_IMAGE} as ubi
 FROM ${GO_IMAGE} as builder
 # setup required packages
diff --git a/Makefile b/Makefile
index 1d73482..46119e9 100644
--- a/Makefile
+++ b/Makefile
@@ -4,21 +4,27 @@ ifeq ($(ARCH),)
 ARCH=$(shell go env GOARCH)
 endif
 
+BUILD_META=-build$(shell date +%Y%m%d)
 ORG ?= rancher
 PKG ?= github.com/coredns/coredns
 SRC ?= github.com/coredns/coredns
-TAG ?= v1.6.9
+TAG ?= v1.6.9$(BUILD_META)
 
 ifneq ($(DRONE_TAG),)
 TAG := $(DRONE_TAG)
 endif
 
+ifeq (,$(filter %$(BUILD_META),$(TAG)))
+$(error TAG needs to end with build metadata: $(BUILD_META))
+endif
+
 .PHONY: image-build
 image-build:
 	docker build \
+		--pull \
 		--build-arg PKG=$(PKG) \
 		--build-arg SRC=$(SRC) \
-		--build-arg TAG=$(TAG) \
+		--build-arg TAG=$(TAG:$(BUILD_META)=) \
 		--tag $(ORG)/hardened-coredns:$(TAG) \
 		--tag $(ORG)/hardened-coredns:$(TAG)-$(ARCH) \
 	.