diff --git a/Dockerfile b/Dockerfile
index 92b7bc1..fd29efe 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 FROM ubuntu:22.04 as tomcat
 
-ARG TOMCAT_VERSION=9.0.84
+ARG TOMCAT_VERSION=9.0.86
 ARG CORS_ENABLED=false
 ARG CORS_ALLOWED_ORIGINS=*
 ARG CORS_ALLOWED_METHODS=GET,POST,PUT,DELETE,HEAD,OPTIONS
diff --git a/README.md b/README.md
index a9585e8..1b64497 100644
--- a/README.md
+++ b/README.md
@@ -104,6 +104,10 @@ The ``startup.sh`` script allows some customization on startup:
   * ``CORS_ALLOW_CREDENTIALS`` (default ``false``) **Setting this to ``true`` will only have the desired effect if ``CORS_ALLOWED_ORIGINS`` defines explicit origins (not ``*``)**
 * ``PROXY_BASE_URL`` to the base URL of the GeoServer web app if GeoServer is behind a proxy. Example: ``https://example.com/geoserver``.
 
+The CORS variables customize tomcat's `web.xml` file. If you need more customization, 
+you can provide your own customized `web.xml` file to tomcat by mounting it into the container 
+at `/opt/config_overrides/web.xml`.
+
 Example installing wps and ysld extensions:
 
 ```shell
diff --git a/startup.sh b/startup.sh
index b1ea25f..5be4084 100755
--- a/startup.sh
+++ b/startup.sh
@@ -133,6 +133,17 @@ fi
 # Use a custom "server.xml" if the user mounted one into the container
 copy_custom_config "server.xml"
 
+# Use a custom "web.xml" if the user mounted one into the container
+if [ -d "${CONFIG_OVERRIDES_DIR}" ] && [ -f "${CONFIG_OVERRIDES_DIR}/web.xml" ]; then
+  echo "Installing configuration override for web.xml with substituted environment variables"
+  
+  if [ "${CORS_ENABLED}" = "true" ]; then 
+    echo "Warning: the CORS_ENABLED's changes will be overwritten!"
+  fi
+  
+  envsubst < "${CONFIG_OVERRIDES_DIR}"/web.xml > "${CATALINA_HOME}/webapps/geoserver/WEB-INF/web.xml"
+fi
+
 # start the tomcat
 # CIS - Tomcat Benchmark recommendations:
 # * Turn off session facade recycling