diff --git a/.github/workflows/jms-build-test.yml b/.github/workflows/jms-build-test.yml
index 33268215..75354532 100644
--- a/.github/workflows/jms-build-test.yml
+++ b/.github/workflows/jms-build-test.yml
@@ -23,7 +23,7 @@ jobs:
         build-args: |
           GOPROXY=direct
           APT_MIRROR=http://deb.debian.org
-        file: Dockerfile
+        file: Dockerfile-ce
         cache-from: type=gha
         cache-to: type=gha,mode=max
 
diff --git a/Dockerfile b/Dockerfile-ce
similarity index 64%
rename from Dockerfile
rename to Dockerfile-ce
index 1c494599..0cada1a3 100644
--- a/Dockerfile
+++ b/Dockerfile-ce
@@ -10,45 +10,35 @@ RUN set -ex \
     && yarn config set registry ${NPM_REGISTRY}
 
 WORKDIR /opt/koko/ui
-ADD ui/package.json ui/yarn.lock .
-RUN --mount=type=cache,target=/usr/local/share/.cache/yarn,sharing=locked,id=koko \
+ADD ui/package.json ui/yarn.lock ./
+RUN --mount=type=cache,target=/usr/local/share/.cache/yarn,sharing=locked,id=koko-yarn \
     yarn install
 
 ADD ui .
-RUN --mount=type=cache,target=/usr/local/share/.cache/yarn,sharing=locked,id=koko \
+RUN --mount=type=cache,target=/usr/local/share/.cache/yarn,sharing=locked,id=koko-yarn \
     yarn build
 
 FROM golang:1.21-bullseye as stage-build
-LABEL stage=stage-build
 ARG TARGETARCH
 
 WORKDIR /opt/koko
-ARG HELM_VERSION=v3.12.2
-ARG DOWNLOAD_URL=https://download.jumpserver.org
-
-RUN set -ex \
-    && echo "no" | dpkg-reconfigure dash
 
+ARG HELM_VERSION=v3.13.3
+ARG KUBECTL_VERSION=v1.29.0
 RUN set -ex \
     && mkdir -p /opt/koko/bin \
-    && wget ${DOWNLOAD_URL}/public/kubectl-linux-${TARGETARCH}.tar.gz -O kubectl.tar.gz \
-    && tar -xf kubectl.tar.gz -C /opt/koko/bin/ \
+    && wget -q -O kubectl.tar.gz https://dl.k8s.io/${KUBECTL_VERSION}/kubernetes-client-linux-${TARGETARCH}.tar.gz \
+    && tar -xf kubectl.tar.gz --strip-components=3 -C /opt/koko/bin/ kubernetes/client/bin/kubectl \
     && mv /opt/koko/bin/kubectl /opt/koko/bin/rawkubectl \
-    && wget -O helm.tar.gz https://get.helm.sh/helm-${HELM_VERSION}-linux-${TARGETARCH}.tar.gz \
+    && wget -q -O helm.tar.gz https://get.helm.sh/helm-${HELM_VERSION}-linux-${TARGETARCH}.tar.gz \
     && tar -xf helm.tar.gz --strip-components=1 -C /opt/koko/bin/ linux-${TARGETARCH}/helm \
     && mv /opt/koko/bin/helm /opt/koko/bin/rawhelm \
-    && \
-    if [ "${TARGETARCH}" == "amd64" ] || [ "${TARGETARCH}" == "arm64" ]; then \
-        wget ${DOWNLOAD_URL}/files/clickhouse/22.20.2.11/clickhouse-client-linux-${TARGETARCH}.tar.gz; \
-        tar -xf clickhouse-client-linux-${TARGETARCH}.tar.gz -C /opt/koko/bin/; \
-    fi \
-    && wget ${DOWNLOAD_URL}/public/kubectl_aliases.tar.gz -O kubectl_aliases.tar.gz \
-    && tar -xf kubectl_aliases.tar.gz \
+    && wget -q https://github.com/ahmetb/kubectl-aliases/raw/master/.kubectl_aliases \
     && chmod +x /opt/koko/bin/* \
     && chown root:root /opt/koko/bin/* \
     && rm -f *.tar.gz
 
-ADD go.mod go.sum .
+ADD go.mod go.sum ./
 
 ARG GOPROXY=https://goproxy.io
 ENV CGO_ENABLED=0
@@ -106,8 +96,8 @@ ARG DEPENDENCIES="                    \
         xz-utils"
 
 ARG APT_MIRROR=http://mirrors.ustc.edu.cn
-
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=koko \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=koko-apt \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked,id=koko-apt \
     sed -i "s@http://.*.debian.org@${APT_MIRROR}@g" /etc/apt/sources.list \
     && rm -f /etc/apt/apt.conf.d/docker-clean \
     && ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \
@@ -116,33 +106,38 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=koko \
     && echo "no" | dpkg-reconfigure dash \
     && echo "zh_CN.UTF-8" | dpkg-reconfigure locales \
     && sed -i "s@# export @export @g" ~/.bashrc \
-    && sed -i "s@# alias @alias @g" ~/.bashrc \
-    && rm -rf /var/lib/apt/lists/*
+    && sed -i "s@# alias @alias @g" ~/.bashrc
 
-ARG MONGOSH_VERSION=1.10.3
+ARG MONGOSH_VERSION=2.1.1
 RUN set -ex \
     && \
     case "${TARGETARCH}" in \
-        amd64) \
-            wget https://downloads.mongodb.com/compass/mongosh-${MONGOSH_VERSION}-linux-x64.tgz \
-            && tar -xf mongosh-${MONGOSH_VERSION}-linux-x64.tgz \
-            && chown root:root mongosh-${MONGOSH_VERSION}-linux-x64/bin/* \
-            && mv mongosh-${MONGOSH_VERSION}-linux-x64/bin/mongosh /usr/local/bin/ \
-            && mv mongosh-${MONGOSH_VERSION}-linux-x64/bin/mongosh_crypt_v1.so /usr/local/lib/ \
-            && rm -rf mongosh-${MONGOSH_VERSION}-linux-x64* \
+        'amd64') \
+            ARCH=x64; \
             ;; \
-        arm64) \
-            wget https://downloads.mongodb.com/compass/mongosh-${MONGOSH_VERSION}-linux-${TARGETARCH}.tgz \
-            && tar -xf mongosh-${MONGOSH_VERSION}-linux-${TARGETARCH}.tgz \
-            && chown root:root mongosh-${MONGOSH_VERSION}-linux-${TARGETARCH}/bin/* \
-            && mv mongosh-${MONGOSH_VERSION}-linux-${TARGETARCH}/bin/mongosh /usr/local/bin/ \
-            && mv mongosh-${MONGOSH_VERSION}-linux-${TARGETARCH}/bin/mongosh_crypt_v1.so /usr/local/lib/ \
-            && rm -rf mongosh-${MONGOSH_VERSION}-linux-${TARGETARCH}* \
+        'arm64') \
+            ARCH=arm64; \
+            ;; \
+        's390x') \
+            ARCH=s390x; \
+            ;; \
+        'ppc64le') \
+            ARCH=ppc64le; \
             ;; \
         *) \
-            echo "Unsupported architecture: ${TARGETARCH}" \
+            echo "Unsupported architecture: ${TARGETARCH}"; \
             ;; \
-    esac
+    esac \
+    && \
+    if [ -n "${ARCH}" ]; then \
+        wget -q https://downloads.mongodb.com/compass/mongosh-${MONGOSH_VERSION}-linux-${ARCH}.tgz \
+        && tar -xf mongosh-${MONGOSH_VERSION}-linux-${ARCH}.tgz \
+        && chown root:root mongosh-${MONGOSH_VERSION}-linux-${ARCH}/bin/* \
+        && mv mongosh-${MONGOSH_VERSION}-linux-${ARCH}/bin/mongosh /usr/local/bin/ \
+        && mv mongosh-${MONGOSH_VERSION}-linux-${ARCH}/bin/mongosh_crypt_v1.so /usr/local/lib/ \
+        && rm -rf mongosh-${MONGOSH_VERSION}-linux-${ARCH}* \
+        ; \
+    fi
 
 COPY --from=redis /usr/local/bin/redis-cli /usr/local/bin/redis-cli
 
diff --git a/Dockerfile-ee b/Dockerfile-ee
new file mode 100644
index 00000000..9f349da9
--- /dev/null
+++ b/Dockerfile-ee
@@ -0,0 +1,36 @@
+ARG VERSION
+FROM debian:bullseye-slim as clickhouse
+ARG TARGETARCH
+
+ARG DEPENDENCIES="      \
+    ca-certificates     \
+    curl"
+
+ARG APT_MIRROR=http://mirrors.ustc.edu.cn
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=koko-apt \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked,id=koko-apt \
+    sed -i "s@http://.*.debian.org@${APT_MIRROR}@g" /etc/apt/sources.list \
+    && rm -f /etc/apt/apt.conf.d/docker-clean \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends ${DEPENDENCIES} \
+    && LATEST_VERSION=$(curl -s https://packages.clickhouse.com/tgz/stable/ | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | sort -V -r | head -n 1) \
+    && PKG="clickhouse-common-static" \
+    && \
+    case "${TARGETARCH}" in \
+        amd64|arm64) \
+            mkdir -p /opt/clickhouse; \
+            curl -fO "https://packages.clickhouse.com/tgz/stable/$PKG-$LATEST_VERSION-${TARGETARCH}.tgz"; \
+            tar -xf "$PKG-$LATEST_VERSION-${TARGETARCH}.tgz" -C /opt/clickhouse --strip-components=1; \
+            rm -f "$PKG-$LATEST_VERSION-${TARGETARCH}.tgz"; \
+            ;; \
+        *) \
+            mkdir -p /opt/clickhouse/usr/bin; \
+            echo > /opt/clickhouse/usr/bin/clickhouse; \
+            ;; \
+    esac \
+    && chown -R root:root /opt/clickhouse
+
+FROM registry.fit2cloud.com/jumpserver/koko-ce:${VERSION}
+
+COPY --from=clickhouse /opt/clickhouse/usr/bin/clickhouse /usr/local/bin/clickhouse-client
+