diff --git a/src/app/Dockerfile b/src/app/Dockerfile
index 55b1915..1ac46b0 100644
--- a/src/app/Dockerfile
+++ b/src/app/Dockerfile
@@ -31,6 +31,9 @@ RUN sh -c ${SCRIPT_ROOT}/build-prepare.sh
 ENV OWNER_UID=1000
 ENV OWNER_GID=1000
 
+# don't try to update local plugins on startup
+ENV TTRSS_NO_STARTUP_PLUGIN_UPDATES=""
+
 # TTRSS_XDEBUG_HOST defaults to host IP if unset
 ENV TTRSS_XDEBUG_ENABLED=""
 ENV TTRSS_XDEBUG_HOST=""
diff --git a/src/app/startup.sh b/src/app/startup.sh
index e3fe0f0..8138b61 100755
--- a/src/app/startup.sh
+++ b/src/app/startup.sh
@@ -46,6 +46,21 @@ for d in cache lock feed-icons plugins.local themes.local; do
 	mkdir -p $DST_DIR/$d
 done
 
+if [ -z "$TTRSS_NO_STARTUP_PLUGIN_UPDATES" ]; then
+	echo updating all local plugins...
+
+	find $DST_DIR/plugins.local -type d -maxdepth 1 | while read PLUGIN; do
+		echo updating $PLUGIN...
+
+		cd $PLUGIN && \
+			git config core.filemode false && \
+			git config pull.rebase false && \
+			git pull origin master || echo warning: attempt to update plugin $PLUGIN failed.
+	done
+else
+	echo skipping local plugin updates, disabled.
+fi
+
 cp ${SCRIPT_ROOT}/config.docker.php $DST_DIR/config.php
 chmod 644 $DST_DIR/config.php
 
diff --git a/src/docker-compose.yml b/src/docker-compose.yml
index 81e723f..4e54b1a 100644
--- a/src/docker-compose.yml
+++ b/src/docker-compose.yml
@@ -9,7 +9,7 @@ services:
     restart: unless-stopped
 
   web-nginx:
-    image: cthulhoo/ttrss-web-nginx:latest
+    image: cthulhoo/ttrss-web-nginx:${BUILD_TAG}
     build: ./web-nginx
     restart: unless-stopped
     depends_on: