diff --git a/CHANGELOG.md b/CHANGELOG.md
index b056fb6..413754e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Added
+- [#66] Update postgresql to 14.20 by using dockerhub image instead of alpine upstream
+- [#66] Update base image to 3.23.2-2
 
 ## [v14.18-3] - 2025-09-19
 ### Added
diff --git a/Dockerfile b/Dockerfile
index 11e60fe..4fefdc2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,44 +1,31 @@
-FROM registry.cloudogu.com/official/base:3.18.9-3 AS builder
+FROM registry.cloudogu.com/official/base:3.23.2-2 AS builder
 
-ENV GOSU_SHA256=bbc4136d03ab138b1ad66fa4fc051bafc6cc7ffae632b069a53657279a450de3
+# get doguctl
 
-WORKDIR /build
-
-RUN set -x -o errexit \
- && set -o nounset \
- && set -o pipefail \
- && apk update \
- && apk upgrade \
- && apk add wget \
- && mkdir -p /build/usr/local/bin \
- && wget --progress=bar:force:noscroll -O /build/usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64" \
- && echo "${GOSU_SHA256} */build/usr/local/bin/gosu" | sha256sum -c - \
- && chmod +x /build/usr/local/bin/gosu
-
-FROM registry.cloudogu.com/official/base:3.18.9-3
+FROM postgres:14.20-alpine3.23
 
 LABEL NAME="official/postgresql" \
-        VERSION="14.18-3" \
-        maintainer="hello@cloudogu.com"
+      VERSION="14.20-0" \
+      maintainer="hello@cloudogu.com"
 
 ENV LANG=en_US.utf8 \
-    PGDATA=/var/lib/postgresql \
-    POSTGRESQL_VERSION=14.18-r0
+    PGDATA=/var/lib/postgresql/data
 
-RUN set -x -o errexit \
- && set -o nounset \
- && set -o pipefail \
- && apk update \
- && apk upgrade \
- && apk add --no-cache --update postgresql14="${POSTGRESQL_VERSION}" postgresql14-contrib="${POSTGRESQL_VERSION}"
+# === Copy doguctl ===
+COPY --from=builder /usr/local/bin/doguctl /usr/local/bin/
 
 COPY resources/ /
-COPY --from=builder /build /
 
-VOLUME ["/var/lib/postgresql"]
+RUN set -eux; \
+    mkdir -p "${PGDATA}"; \
+    chown -R postgres:postgres "${PGDATA}"
+
+VOLUME ["/var/lib/postgresql/data"]
 
 HEALTHCHECK --interval=5s CMD doguctl healthy postgresql || exit 1
 
 EXPOSE 5432
 
+ENTRYPOINT []
+
 CMD ["/startup.sh"]
diff --git a/dogu.json b/dogu.json
index eb9206a..f540d72 100644
--- a/dogu.json
+++ b/dogu.json
@@ -1,6 +1,6 @@
 {
   "Name": "official/postgresql",
-  "Version": "14.18-3",
+  "Version": "14.20-0",
   "DisplayName": "PostgreSQL",
   "Description": "PostgreSQL Database.",
   "Url": "https://www.postgresql.org/",
diff --git a/resources/post-upgrade.sh b/resources/post-upgrade.sh
index 643c53a..1db89f5 100755
--- a/resources/post-upgrade.sh
+++ b/resources/post-upgrade.sh
@@ -21,7 +21,26 @@ function prepareForBackup() {
 
 function startPostgresql() {
     echo "start postgresql"
-    gosu postgres postgres &
+
+    # Migrate legacy PGDATA layout:
+    # Older images (<v14.20)initialized PostgreSQL in /var/lib/postgresql (parent dir),
+    # but the current image mounts /var/lib/postgresql/data as the real PGDATA.
+    # PostgreSQL requires the cluster root to be exactly the mounted directory,
+    # so we move the existing cluster into /data once to match the new layout.
+
+    # Allow postgres to traverse into the mounted volume
+    chmod 755 /var/lib/postgresql
+    # move everything except data/
+    for f in /var/lib/postgresql/*; do
+      [ "$f" = "/var/lib/postgresql/data" ] && continue
+      mv "$f" /var/lib/postgresql/data/
+    done
+    # Ensure correct perms inside the volume
+    chown -R postgres:postgres "$PGDATA"
+    chmod 700 "$PGDATA"
+
+    exec gosu postgres postgres -D "$PGDATA"
+
     PID=$!
 
     while ! pg_isready >/dev/null; do
diff --git a/resources/startup.sh b/resources/startup.sh
index 9c9106b..e8d27bc 100755
--- a/resources/startup.sh
+++ b/resources/startup.sh
@@ -126,15 +126,15 @@ function setDoguLogLevel() {
     ;;
   esac
   # Remove old log level setting, if existent
-  sed -i '/^log_min_messages/d' /var/lib/postgresql/postgresql.conf
+  sed -i '/^log_min_messages/d' "${PGDATA}"/postgresql.conf
   # Append new log level setting
-  echo "log_min_messages = ${POSTGRESQL_LOGLEVEL}" >>/var/lib/postgresql/postgresql.conf
+  echo "log_min_messages = ${POSTGRESQL_LOGLEVEL}" >> "${PGDATA}"/postgresql.conf
 }
 
 function setMaxConnections() {
   # replace default max connection count with configured max connection count
   cons=$(doguctl config 'database_config/max_connections')
-  sed -i "/max_connections/c\max_connections = ${cons}" /var/lib/postgresql/postgresql.conf
+  sed -i "/max_connections/c\max_connections = ${cons}" "${PGDATA}"/postgresql.conf
 }
 
 function runMain() {
@@ -147,7 +147,7 @@ function runMain() {
   # Give the postgres user the necessary permissions
   chownPgdata
 
-  if [ -z "$(ls -A "$PGDATA")" ]; then
+  if [ ! -f "$PGDATA/PG_VERSION" ]; then
     initializePostgreSQL
   fi
 
diff --git a/resources/util.sh b/resources/util.sh
index 8071f2b..8a481f0 100644
--- a/resources/util.sh
+++ b/resources/util.sh
@@ -8,6 +8,8 @@ function initializePostgreSQL() {
     # set stage for health check
     doguctl state installing
 
+    ls -la $PGDATA
+
     # install database
     gosu postgres initdb
 
diff --git a/spec/goss/goss.yaml b/spec/goss/goss.yaml
index 25f96d9..c9a3052 100644
--- a/spec/goss/goss.yaml
+++ b/spec/goss/goss.yaml
@@ -34,13 +34,10 @@ file:
     owner: root
     group: root
     filetype: file
-  /var/lib/postgresql:
+  /var/lib/postgresql/data:
     exists: true
     owner: postgres
     filetype: directory
-package:
-  postgresql14:
-    installed: true
 port:
   tcp:5432:
     listening: true
@@ -50,6 +47,6 @@ process:
   postgres:
     running: true
 mount:
-  /var/lib/postgresql:
+  /var/lib/postgresql/data:
     exists: true
     filesystem: btrfs