diff --git a/docs/usage/self-hosted-configuration.md b/docs/usage/self-hosted-configuration.md
index 80c151a4b25ab1..a79992b1d8be30 100644
--- a/docs/usage/self-hosted-configuration.md
+++ b/docs/usage/self-hosted-configuration.md
@@ -141,11 +141,16 @@ This mode means that Renovate will dynamically install the version of tools avai
 
 Supported tools for dynamic install are:
 
+- `bundler`
+- `cargo`
 - `composer`
 - `flux`
 - `gradle-wrapper`
 - `jb`
+- `jsonnet-bundler`
+- `mix`
 - `npm`
+- `pipenv`
 
 Tools not on this list fall back to `binarySource=global`.
 
diff --git a/lib/modules/manager/pipenv/__snapshots__/artifacts.spec.ts.snap b/lib/modules/manager/pipenv/__snapshots__/artifacts.spec.ts.snap
index 79eb5b549ac8f6..0f0a0dcdb4590a 100644
--- a/lib/modules/manager/pipenv/__snapshots__/artifacts.spec.ts.snap
+++ b/lib/modules/manager/pipenv/__snapshots__/artifacts.spec.ts.snap
@@ -99,19 +99,19 @@ Array [
 exports[`modules/manager/pipenv/artifacts supports docker mode 1`] = `
 Array [
   Object {
-    "cmd": "docker pull renovate/python:latest",
+    "cmd": "docker pull renovate/sidecar",
     "options": Object {
       "encoding": "utf-8",
     },
   },
   Object {
-    "cmd": "docker ps --filter name=renovate_python -aq",
+    "cmd": "docker ps --filter name=renovate_sidecar -aq",
     "options": Object {
       "encoding": "utf-8",
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_python --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -e PIPENV_CACHE_DIR -e BUILDPACK_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/python:latest bash -l -c \\"pip install --user pipenv && pipenv lock\\"",
+    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -e PIPENV_CACHE_DIR -e BUILDPACK_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/sidecar bash -l -c \\"install-tool python 3.10.2 && pip install --user pipenv && pipenv lock\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -136,19 +136,19 @@ Array [
 exports[`modules/manager/pipenv/artifacts uses pipenv version from Pipfile 1`] = `
 Array [
   Object {
-    "cmd": "docker pull renovate/python",
+    "cmd": "docker pull renovate/sidecar",
     "options": Object {
       "encoding": "utf-8",
     },
   },
   Object {
-    "cmd": "docker ps --filter name=renovate_python -aq",
+    "cmd": "docker ps --filter name=renovate_sidecar -aq",
     "options": Object {
       "encoding": "utf-8",
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_python --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -e PIPENV_CACHE_DIR -e BUILDPACK_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/python bash -l -c \\"pip install --user pipenv==2020.8.13 && pipenv lock\\"",
+    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -e PIPENV_CACHE_DIR -e BUILDPACK_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/sidecar bash -l -c \\"install-tool python 3.10.2 && pip install --user pipenv==2020.8.13 && pipenv lock\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -173,19 +173,19 @@ Array [
 exports[`modules/manager/pipenv/artifacts uses pipenv version from Pipfile dev packages 1`] = `
 Array [
   Object {
-    "cmd": "docker pull renovate/python",
+    "cmd": "docker pull renovate/sidecar",
     "options": Object {
       "encoding": "utf-8",
     },
   },
   Object {
-    "cmd": "docker ps --filter name=renovate_python -aq",
+    "cmd": "docker ps --filter name=renovate_sidecar -aq",
     "options": Object {
       "encoding": "utf-8",
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_python --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -e PIPENV_CACHE_DIR -e BUILDPACK_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/python bash -l -c \\"pip install --user pipenv==2020.8.13 && pipenv lock\\"",
+    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -e PIPENV_CACHE_DIR -e BUILDPACK_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/sidecar bash -l -c \\"install-tool python 3.10.2 && pip install --user pipenv==2020.8.13 && pipenv lock\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -210,19 +210,19 @@ Array [
 exports[`modules/manager/pipenv/artifacts uses pipenv version from config 1`] = `
 Array [
   Object {
-    "cmd": "docker pull renovate/python",
+    "cmd": "docker pull renovate/sidecar",
     "options": Object {
       "encoding": "utf-8",
     },
   },
   Object {
-    "cmd": "docker ps --filter name=renovate_python -aq",
+    "cmd": "docker ps --filter name=renovate_sidecar -aq",
     "options": Object {
       "encoding": "utf-8",
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_python --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -e PIPENV_CACHE_DIR -e BUILDPACK_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/python bash -l -c \\"pip install --user pipenv==2020.1.1 && pipenv lock\\"",
+    "cmd": "docker run --rm --name=renovate_sidecar --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -e PIPENV_CACHE_DIR -e BUILDPACK_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/sidecar bash -l -c \\"install-tool python 3.10.2 && pip install --user pipenv==2020.1.1 && pipenv lock\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
diff --git a/lib/modules/manager/pipenv/artifacts.spec.ts b/lib/modules/manager/pipenv/artifacts.spec.ts
index 637c2804e399ad..1bf73d74475570 100644
--- a/lib/modules/manager/pipenv/artifacts.spec.ts
+++ b/lib/modules/manager/pipenv/artifacts.spec.ts
@@ -1,10 +1,11 @@
 import { join } from 'upath';
 import { envMock, mockExecAll } from '../../../../test/exec-util';
-import { env, fs, git } from '../../../../test/util';
+import { env, fs, git, mockedFunction } from '../../../../test/util';
 import { GlobalConfig } from '../../../config/global';
 import type { RepoGlobalConfig } from '../../../config/types';
 import * as docker from '../../../util/exec/docker';
 import type { StatusResult } from '../../../util/git/types';
+import { getPkgReleases as _getPkgReleases } from '../../datasource';
 import type { UpdateArtifactsConfig } from '../types';
 import * as pipenv from '.';
 
@@ -13,6 +14,9 @@ jest.mock('../../../util/git');
 jest.mock('../../../util/fs');
 jest.mock('../../../util/host-rules');
 jest.mock('../../../util/http');
+jest.mock('../../datasource');
+
+const getPkgReleases = mockedFunction(_getPkgReleases);
 
 const adminConfig: RepoGlobalConfig = {
   // `join` fixes Windows CI
@@ -43,6 +47,15 @@ describe('modules/manager/pipenv/artifacts', () => {
       default: { pipenv: {} },
       develop: { pipenv: {} },
     };
+
+    // python
+    getPkgReleases.mockResolvedValueOnce({
+      releases: [
+        { version: '3.8.5' },
+        { version: '3.9.1' },
+        { version: '3.10.2' },
+      ],
+    });
   });
 
   it('returns if no Pipfile.lock found', async () => {
diff --git a/lib/modules/manager/pipenv/artifacts.ts b/lib/modules/manager/pipenv/artifacts.ts
index 0561da096e6b1c..506afc684a27cd 100644
--- a/lib/modules/manager/pipenv/artifacts.ts
+++ b/lib/modules/manager/pipenv/artifacts.ts
@@ -101,11 +101,15 @@ export async function updateArtifacts({
         PIPENV_CACHE_DIR: await ensureCacheDir('pipenv'),
       },
       docker: {
-        image: 'python',
-        tagConstraint,
-        tagScheme: 'pep440',
+        image: 'sidecar',
       },
       preCommands: [`pip install --user ${quote(`pipenv${pipenvConstraint}`)}`],
+      toolConstraints: [
+        {
+          toolName: 'python',
+          constraint: tagConstraint,
+        },
+      ],
     };
     logger.debug({ cmd }, 'pipenv lock command');
     await exec(cmd, execOptions);
diff --git a/lib/util/exec/buildpack.ts b/lib/util/exec/buildpack.ts
index 09c94432c48ced..97b7e365e58d83 100644
--- a/lib/util/exec/buildpack.ts
+++ b/lib/util/exec/buildpack.ts
@@ -79,6 +79,11 @@ const allToolConfig: Record<string, ToolConfig> = {
     depName: 'poetry',
     versioning: pep440VersioningId,
   },
+  python: {
+    datasource: 'github-releases',
+    depName: 'containerbase/python-prebuild',
+    versioning: pep440VersioningId,
+  },
   yarn: {
     datasource: 'npm',
     depName: 'yarn',