diff --git a/.github/workflows/build-wheels.yml b/.github/workflows/build-wheels.yml
index 256858168..da6720cfb 100644
--- a/.github/workflows/build-wheels.yml
+++ b/.github/workflows/build-wheels.yml
@@ -294,6 +294,7 @@ jobs:
 
     - name: Build wheel
       uses: pypa/cibuildwheel@v2.21.3
+      id: cibuildwheel
       env:
         # manylinux_2_28 x64 image doesn't search in this directory for shared libraries
         CIBW_ENVIRONMENT_LINUX: LD_LIBRARY_PATH=/usr/local/lib64
diff --git a/.github/workflows/manylinux_2_28-openssl.Dockerfile b/.github/workflows/manylinux_2_28-openssl.Dockerfile
index 938cbafd3..5d0bde7af 100644
--- a/.github/workflows/manylinux_2_28-openssl.Dockerfile
+++ b/.github/workflows/manylinux_2_28-openssl.Dockerfile
@@ -1,5 +1,6 @@
 ARG CPU_ARCH=x86_64
-FROM quay.io/pypa/manylinux_2_28_$CPU_ARCH
+ARG BASE_IMAGE
+FROM $BASE_IMAGE
 ARG OPENSSL_VERSION
 LABEL com.aerospike.clients.openssl-version=$OPENSSL_VERSION
 
diff --git a/.github/workflows/update-manylinux-openssl-image.yml b/.github/workflows/update-manylinux-openssl-image.yml
index 014d4e45e..3bbcfcffc 100644
--- a/.github/workflows/update-manylinux-openssl-image.yml
+++ b/.github/workflows/update-manylinux-openssl-image.yml
@@ -14,6 +14,7 @@ jobs:
   main:
     env:
       REGISTRY: ghcr.io
+      CIBW_PINNED_DOCKER_IMAGE_CONFIG_PATH: cibuildwheel/resources/pinned_docker_images.cfg
     strategy:
       matrix:
         arch-and-runner-os: [
@@ -28,9 +29,7 @@ jobs:
       with:
         sparse-checkout: |
           .github/workflows
-
-    # TODO: use same version as in pinned cibuildwheel version
-    - run: docker pull quay.io/pypa/${{ env.MANYLINUX_TAG }}_${{ matrix.arch-and-runner-os[0] }}
+        path: aerospike-client-python
 
     - uses: docker/login-action@v3
       with:
@@ -48,15 +47,52 @@ jobs:
     - name: Set up Docker Buildx so we can cache our Docker image layers
       uses: docker/setup-buildx-action@v3
 
+    - name: Get cibuildwheel version used to build wheels
+      run: echo CIBW_VERSION=$(yq eval '.jobs.cibuildwheel.steps | map(select(.id == "cibuildwheel"))[0].uses' build-wheels.yml | cut -f 2- -d "@") >> $GITHUB_ENV
+      working-directory: aerospike-client-python/.github/workflows
+
+    - uses: actions/checkout@v4
+      with:
+        repository: pypa/cibuildwheel
+        ref: ${{ env.CIBW_VERSION }}
+        sparse-checkout: |
+          ${{ env.CIBW_PINNED_DOCKER_IMAGE_CONFIG_PATH }}
+        sparse-checkout-cone-mode: false
+        path: cibuildwheel
+
+    - name: Get manylinux base image to use
+      id: get-manylinux-base-image
+      run: |
+        import os
+        import configparser
+
+        config = configparser.ConfigParser()
+        config.read('${{ env.CIBW_PINNED_DOCKER_IMAGE_CONFIG_PATH }}')
+        BASE_IMAGE = config['${{ matrix.arch-and-runner-os[0] }}']['${{ env.MANYLINUX_TAG }}']
+
+        output_file = os.getenv('GITHUB_OUTPUT')
+        if not output_file:
+          print(f"Error: GITHUB_OUTPUT environment variable not found.")
+          exit(1)
+
+        with open(output_file, 'a') as f:
+          print("base image:", BASE_IMAGE)
+          f.write(f"manylinux_base_image={BASE_IMAGE}\n")
+      shell: python
+      working-directory: cibuildwheel
+
     - name: Build and push
       uses: docker/build-push-action@v6
       with:
         # Don't want to use default Git context or else it will clone the whole Python client repo again
-        context: .github/workflows
-        file: .github/workflows/${{ env.MANYLINUX_TAG }}-openssl.Dockerfile
+        # TODO: review how main repo is cloned
+        context: ${{ github.workspace }}/aerospike-client-python/.github/workflows
+        file: ${{ github.workspace }}/aerospike-client-python/.github/workflows/${{ env.MANYLINUX_TAG }}-openssl.Dockerfile
         build-args: |
           OPENSSL_VERSION=${{ inputs.openssl-version }}
           CPU_ARCH=${{ matrix.arch-and-runner-os[0] }}
+          BASE_IMAGE=${{ steps.get-manylinux-base-image.outputs.manylinux_base_image }}
+        pull: true
         # setup-buildx-action configures Docker to use the docker-container build driver
         # This driver doesn't publish an image locally by default
         # so we have to manually enable it