diff --git a/.drone.yml b/.drone.yml
index 5fb8759..df864fd 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -3,6 +3,19 @@ type: docker
 name: build-latest
 
 steps:
+- name: test
+  image: python:3.12-slim-bookworm
+  settings:
+    repo: git.thisfro.ch/pflaenz.li/pflaenzli
+  environment:
+    DJANGO_ALLOWED_HOSTS: localhost,[::1]
+    DJANGO_CSRF_TRUSTED_ORIGINS: http://localhost:8000
+  commands:
+    - pip install coverage
+    - pip install -r requirements.txt
+    - coverage run --branch --source='.' pflaenzli/manage.py test pflaenzli
+    - coverage report -m
+
 - name: build-image
   image: plugins/docker
   settings:
diff --git a/Dockerfile b/Dockerfile
index 56968bb..7fd3f0e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.11-slim-bullseye
+FROM python:3.12-slim-bookworm
 
 RUN apt update && apt install -y libpq-dev nginx gettext
 
diff --git a/pflaenzli/pflaenzli/views.py b/pflaenzli/pflaenzli/views.py
index 772bad2..8fb8bc9 100644
--- a/pflaenzli/pflaenzli/views.py
+++ b/pflaenzli/pflaenzli/views.py
@@ -203,7 +203,7 @@ def get_single_plz(plz):
 
 
 def save_language(request):
-    referer_url = request.META.get('HTTP_REFERER')
+    referer_url = request.headers.get('referer')
     response = redirect(referer_url)
 
     if request.method == 'POST':
diff --git a/pflaenzli/pflaenzli_django/settings.py b/pflaenzli/pflaenzli_django/settings.py
index ea9fc1e..afb89b4 100644
--- a/pflaenzli/pflaenzli_django/settings.py
+++ b/pflaenzli/pflaenzli_django/settings.py
@@ -30,10 +30,10 @@ BASE_DIR = Path(__file__).resolve().parent.parent
 SECRET_KEY = "django-insecure-q=ps#iypevr!3zfpwtfp3lw#4r3%oyj*(2=*iq^8f4_zbodi^("
 
 # SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = os.getenv('DJANGO_DEBUG') == 'true'
+DEBUG = True
 
-ALLOWED_HOSTS = os.getenv('DJANGO_ALLOWED_HOSTS', '').split(',')
-CSRF_TRUSTED_ORIGINS = os.getenv('DJANGO_CSRF_TRUSTED_ORIGINS', '').split(',')
+ALLOWED_HOSTS = os.getenv('DJANGO_ALLOWED_HOSTS', 'localhost').split(',')
+CSRF_TRUSTED_ORIGINS = os.getenv('DJANGO_CSRF_TRUSTED_ORIGINS', 'http://localhost:8080').split(',')
 
 # Application definition