diff --git a/roles/paas-docker/devel/files/arc.sh b/roles/paas-docker/devel/files/arc.sh
index e9e6bff..0de0e9b 100755
--- a/roles/paas-docker/devel/files/arc.sh
+++ b/roles/paas-docker/devel/files/arc.sh
@@ -1,100 +1,117 @@
 #!/usr/bin/env bash
 
 #   -------------------------------------------------------------
 #   Phabricator — Arcanist Docker container wrapper
 #   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 #   Author:         Sébastien Santoro aka Dereckson
 #   Project:        Nasqueron
 #   Created:        2016-01-01
 #   Description:    Wrapper to run Arcanist as a Docker container
 #   License:        Trivial work, not eligible to copyright
+#                   If copyright eligible, BSD-2-Clause
 #   Image:          nasqueron/arcanist
 #   Source file:    roles/paas-docker/devel/files/arc.sh
 #   -------------------------------------------------------------
 #
 #   <auto-generated>
 #       This file is managed by our rOPS SaltStack repository.
 #
 #       Changes to this file may cause incorrect behavior
 #       and will be lost if the state is redeployed.
 #   </auto-generated>
 
+BASE_IMAGE=nasqueron/arcanist
+
 #   -------------------------------------------------------------
 #   Parse arguments
 #   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 
 if [ -t 0 ]; then
 	# If a stdin entry is available
 	# launch the container in the
 	# interactive mode
 	FLAGS=-it
 fi
 
 # Logs are default disabled
 PRINT_LOG=0
 
+UPDATE_MODE=0
+
 if [ "$1" = "shell" ]; then
 	# Launch commands
 	# in the container bash shell
 	shift
 	COMMAND=bash
+elif [ "$1" = "update" ]; then
+	UPDATE_MODE=1
 else
 	# Launch arc
 	mkdir -p ~/.arc
 	COMMAND=arc
 
 	if [ "$1" = "call-conduit" ]; then
 		# Enable log printing
 		PRINT_LOG=1
 		# Set a random name for the container
 		INSTANCE="arc-"$(openssl rand -hex 21)
 		FLAGS="-i -a=stdin --name=$INSTANCE"
 	fi
 fi
 
 #   -------------------------------------------------------------
 #   Build image
 #   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 
 build_user_image () {
 	BUILD_DIR=$(mktemp -d -t arc-build-XXXXXXXXXX)
 	pushd "$BUILD_DIR" > /dev/null || exit 1
 	>&2 echo "🔨 Building user-specific image $IMAGE for $USER"
-	echo "FROM nasqueron/arcanist" > Dockerfile
+	echo "FROM $BASE_IMAGE" > Dockerfile
 	echo "RUN groupadd -r $USER -g $GID && mkdir /home/$USER && useradd -u $UID -r -g $USER -d /home/$USER -s /bin/bash $USER && cp /root/.bashrc /home/$USER/ && chown -R $USER:$USER /home/$USER && ln -s /opt/config/gitconfig /home/$USER/.gitconfig && ln -s /opt/config/arcrc /home/$USER/.arcrc" >> Dockerfile
 	docker build -t "$IMAGE" .
 	popd > /dev/null
 	rm -rf "$BUILD_DIR"
 }
 
 test -v $UID && UID=$(id -u)
 test -v $GID && GID=$(id -g)
 
+if [ $UPDATE_MODE -eq 1 ]; then
+	docker pull $BASE_IMAGE
+
+	# Rebuild user image
+	IMAGE=$BASE_IMAGE:$UID-$GID
+	test $UID -eq 0 || build_user_image
+
+	exit
+fi
+
 if [ $UID -eq 0 ]; then
-	IMAGE=nasqueron/arcanist
+	IMAGE=$BASE_IMAGE
 	CONTAINER_USER_HOME=/root
 else
-	IMAGE=nasqueron/arcanist:$UID-$GID
+	IMAGE=$BASE_IMAGE:$UID-$GID
 	test ! -z $(docker images -q "$IMAGE") || build_user_image
 	CONTAINER_USER_HOME="/home/$USER"
 fi
 
 #   -------------------------------------------------------------
 #   Run container
 #   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 
 
 if [ -d ~/.arc/ssh ]; then
 	VOLUME_SSH="-v $HOME/.arc/ssh:$CONTAINER_USER_HOME/.ssh"
 else
 	VOLUME_SSH=""
 fi
 
 if [ $PRINT_LOG -eq 0 ]; then
 	docker run $FLAGS --rm --user $UID:$GID -v ~/.arc:/opt/config -v "$PWD:/opt/workspace" $VOLUME_SSH $IMAGE $COMMAND "$@"
 else
 	docker run $FLAGS --user $UID:$GID -v ~/.arc:/opt/config -v "$PWD:/opt/workspace" $VOLUME_SSH $IMAGE $COMMAND "$@" > /dev/null
 	sleep 3
 	docker logs "$INSTANCE"
 	docker rm "$INSTANCE" >/dev/null
 fi