diff --git a/.scripts/upload_new_keycloak_version.sh b/.scripts/upload_new_keycloak_version.sh
new file mode 100755
index 000000000..3f0f9da20
--- /dev/null
+++ b/.scripts/upload_new_keycloak_version.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+VERSION=${1:?"Missing version number argument (arg 1)"}
+NEXUS_USER=${2:?"Missing Nexus username argument (arg 2)"}
+
+read -r -s -p "Nexus Password: " NEXUS_PASSWORD
+echo ""
+
+# https://stackoverflow.com/questions/4632028/how-to-create-a-temporary-directory
+# Find the directory name of the script
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+# the temp directory used, within $DIR
+WORK_DIR=$(mktemp -d -p "$DIR")
+
+# check if tmp dir was created
+if [[ ! "$WORK_DIR" || ! -d "$WORK_DIR" ]]; then
+  echo "Could not create temp dir"
+  exit 1
+fi
+
+# deletes the temp directory
+function cleanup {
+  rm -rf "$WORK_DIR"
+}
+
+# register the cleanup function to be called on the EXIT signal
+trap cleanup EXIT
+
+cd "$WORK_DIR" || exit
+
+file=keycloak-$VERSION.tar.gz
+
+echo "Downloading $file from github.com"
+curl --fail -LO --progress-bar "https://github.com/keycloak/keycloak/releases/download/$VERSION/$file"
+
+echo "Uploading $file to Nexus"
+curl --fail -o /dev/null --progress-bar -u "$NEXUS_USER:$NEXUS_PASSWORD" \
+    --upload-file "$file" \
+    'https://repo.stackable.tech/repository/packages/keycloak/'
+
+echo "Successfully uploaded new version $VERSION to Nexus"
+echo "https://repo.stackable.tech/service/rest/repository/browse/packages/keycloak/"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 650a2a381..5f2d0b988 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,6 +24,7 @@ All notable changes to this project will be documented in this file.
 - spark: Add `4.0.1` ([#1286]).
 - spark-connect-client: Add `4.0.1` ([#1286]).
 - trino/trino-storage-connector: Add `477` ([#1285]).
+- testing-tools: Add `upload_new_keycloak_version.sh` script ([#1289]).
 
 ### Changed
 
@@ -38,6 +39,7 @@ All notable changes to this project will be documented in this file.
 - opa: Deprecate `1.4.2` ([#1279]).
 - trino-cli: Bump to 477 ([#1285]).
 - tools: Bump dependency versions - kubectl to `1.34.1`, yq to `4.47.2`, and jq to `1.8.1` ([#1290]).
+- testing-tools: Update keycloak dependency to `26.3.5` and `python:3.12-slim-bullseye` base image ([#1289]).
 
 ### Removed
 
@@ -76,6 +78,7 @@ All notable changes to this project will be documented in this file.
 [#1284]: https://github.com/stackabletech/docker-images/pull/1284
 [#1285]: https://github.com/stackabletech/docker-images/pull/1285
 [#1286]: https://github.com/stackabletech/docker-images/pull/1286
+[#1289]: https://github.com/stackabletech/docker-images/pull/1289
 [#1290]: https://github.com/stackabletech/docker-images/pull/1290
 
 ## [25.7.0] - 2025-07-23
diff --git a/testing-tools/Dockerfile b/testing-tools/Dockerfile
index 4b12ee4b0..9bb2e64e4 100644
--- a/testing-tools/Dockerfile
+++ b/testing-tools/Dockerfile
@@ -5,7 +5,7 @@
 # https://hub.docker.com/_/python/tags
 # In Docker Hub, open up the tag and look for Index Digest. Otherwise do:
 # docker pull python:3.12-slim-bullseye and see the digest that appears in the output.
-FROM python:3.12-slim-bullseye@sha256:f6d639b794b394cbeb7a9327d5af9976f0e8d61353bcf41916984775c9bbed1a
+FROM python:3.12-slim-bullseye@sha256:411fa4dcfdce7e7a3057c45662beba9dcd4fa36b2e50a2bfcd6c9333e59bf0db
 
 ARG PRODUCT_VERSION
 ARG RELEASE_VERSION
diff --git a/testing-tools/README.md b/testing-tools/README.md
index bd2998d02..166b64f55 100644
--- a/testing-tools/README.md
+++ b/testing-tools/README.md
@@ -1,4 +1,4 @@
 # Stackable testing tools image
 
-* Based on debian/python 3.11 unlike `tools` which is based on UBI9 with python 3.9.
+* Based on debian/python 3.12 unlike `tools` which is based on UBI9 with python 3.9.
 * Comes with Python packages needed by the kuttl tests.
diff --git a/testing-tools/boil-config.toml b/testing-tools/boil-config.toml
index 278624036..6a4d620fb 100644
--- a/testing-tools/boil-config.toml
+++ b/testing-tools/boil-config.toml
@@ -1,2 +1,2 @@
 [versions."0.2.0".build-arguments]
-keycloak-version = "23.0.0"
+keycloak-version = "26.3.5"