diff --git a/.github/workflows/workflow.yml b/.github/workflows/workflow.yml
index 0ac0c68..5b6c379 100644
--- a/.github/workflows/workflow.yml
+++ b/.github/workflows/workflow.yml
@@ -16,7 +16,6 @@ env:
   PYTHON313: '3.13.16'
   PYTHON312: '3.12.15'
   PYTHON311: '3.11.17'
-  PYTHON310: '3.10.22'
 
 jobs:
   setup:
@@ -31,8 +30,7 @@ jobs:
             {"key": "python314", "version": "${{ env.PYTHON314 }}", "latest": "latest", "latest_major": "3"},
             {"key": "python313", "version": "${{ env.PYTHON313 }}", "latest": "", "latest_major": ""},
             {"key": "python312", "version": "${{ env.PYTHON312 }}", "latest": "", "latest_major": ""},
-            {"key": "python311", "version": "${{ env.PYTHON311 }}", "latest": "", "latest_major": ""},
-            {"key": "python310", "version": "${{ env.PYTHON310 }}", "latest": "", "latest_major": ""}
+            {"key": "python311", "version": "${{ env.PYTHON311 }}", "latest": "", "latest_major": ""}
           ]
           EOF
           echo "python-versions=$(cat versions.json | jq -c .)" >> $GITHUB_OUTPUT
diff --git a/.grype.yaml b/.grype.yaml
index d3cb027..558b527 100644
--- a/.grype.yaml
+++ b/.grype.yaml
@@ -1,32 +1,9 @@
-# Temporary acceptance of CVE-2026-7210 in the unpatched upstream Python 3.10.21.
-# Remove after adopting an official Python 3.10 image containing the XML hash-salt fix.
-# Tracked in https://github.com/wodby/python/issues/10
+# Python 3.11.17 contains the upstream tarfile fix, but the vulnerability data does not list a
+# fixed 3.11 release yet: https://github.com/python/cpython/pull/158455
+# Remove once the scan passes without it: https://github.com/wodby/python/issues/21
 ignore:
-  - vulnerability: CVE-2026-7210
-    package:
-      name: python
-      version: 3.10.21
-      type: binary
-  # Temporary acceptance until the official Python 3.10–3.13 images include the tarfile fix.
-  # https://github.com/python/cpython/pull/157192
-  # Remove after upgrading: https://github.com/wodby/python/issues/12
-  - vulnerability: CVE-2026-82049
-    package:
-      name: python
-      version: 3.13.15
-      type: binary
-  - vulnerability: CVE-2026-82049
-    package:
-      name: python
-      version: 3.12.14
-      type: binary
-  - vulnerability: CVE-2026-82049
-    package:
-      name: python
-      version: 3.11.16
-      type: binary
   - vulnerability: CVE-2026-82049
     package:
       name: python
-      version: 3.10.21
+      version: 3.11.17
       type: binary
diff --git a/.image-revision-aliases.json b/.image-revision-aliases.json
index 7b826b0..70685cc 100644
--- a/.image-revision-aliases.json
+++ b/.image-revision-aliases.json
@@ -104,31 +104,6 @@
           "full": "{version}-dev-macos"
         }
       ]
-    },
-    {
-      "version": {
-        "env": "PYTHON310"
-      },
-      "variants": [
-        {
-          "short": [
-            "{minor}"
-          ],
-          "full": "{version}"
-        },
-        {
-          "short": [
-            "{minor}-dev"
-          ],
-          "full": "{version}-dev"
-        },
-        {
-          "short": [
-            "{minor}-dev-macos"
-          ],
-          "full": "{version}-dev-macos"
-        }
-      ]
     }
   ]
 }
diff --git a/README.md b/README.md
index cdd89dd..6dd8f6a 100644
--- a/README.md
+++ b/README.md
@@ -43,17 +43,14 @@ Supported tags and respective `Dockerfile` links:
 - `3.13` [_(Dockerfile)_]
 - `3.12` [_(Dockerfile)_]
 - `3.11` [_(Dockerfile)_]
-- `3.10` [_(Dockerfile)_]
 - `3.14-dev`, `3-dev` [_(Dockerfile)_]
 - `3.13-dev` [_(Dockerfile)_]
 - `3.12-dev` [_(Dockerfile)_]
 - `3.11-dev` [_(Dockerfile)_]
-- `3.10-dev` [_(Dockerfile)_]
 - `3.14-dev-macos`, `3-dev-macos` [_(Dockerfile)_]
 - `3.13-dev-macos` [_(Dockerfile)_]
 - `3.12-dev-macos` [_(Dockerfile)_]
 - `3.11-dev-macos` [_(Dockerfile)_]
-- `3.10-dev-macos` [_(Dockerfile)_]
 
 [_(Dockerfile)_]: https://github.com/wodby/python/tree/master/Dockerfile
 
diff --git a/base-images.mk b/base-images.mk
index 04300e8..6686a8a 100644
--- a/base-images.mk
+++ b/base-images.mk
@@ -3,7 +3,6 @@
 BASE_IMAGE_REPOSITORY := python
 BASE_IMAGE_VERSION_SUFFIX := -alpine
 
-BASE_IMAGE_DIGEST_3.10.22-alpine := sha256:c3a48015ed1daf66afcafa7a02b7a24af8a51b8037964c03de578032556ec5b3
 BASE_IMAGE_DIGEST_3.11.17-alpine := sha256:faa35f7f7a56c17c2796719f9903b42cb17d59e671a6a74bf85549432e38770e
 BASE_IMAGE_DIGEST_3.12.15-alpine := sha256:8a001d79e5a57ae4de7faa57af12f3d589058ea06ac42ec850c1cb0ac325bd21
 BASE_IMAGE_DIGEST_3.13.16-alpine := sha256:1ac543fc677b1e24cfb220f2e9f2c73d6d9f1d5e718c2bbe5801cae34732f899