diff --git a/Dockerfile b/Dockerfile
index d5e4dcf..11f9b9d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,8 @@
-FROM openjdk:8u151-jdk-alpine
+FROM adoptopenjdk/openjdk8:latest
 
-RUN apk add --no-cache curl tar bash jq libxml2-utils
-
-# https://github.com/concourse/concourse/issues/2042
-RUN unlink  $JAVA_HOME/jre/lib/security/cacerts && \
-    cp /etc/ssl/certs/java/cacerts $JAVA_HOME/jre/lib/security/cacerts
+RUN apt-get update \
+    && apt-get install -y curl tar bash jq xqilla \
+    && rm -rf /var/lib/apt/lists/*
 
 ADD assets/ /opt/resource/
 ADD test/ /opt/resource/test/
diff --git a/README.md b/README.md
index 1d1a9fd..a67e914 100644
--- a/README.md
+++ b/README.md
@@ -15,6 +15,8 @@ Deploys and retrieve artifacts from a Maven Repository Manager.
 
 * `artifact`: *Required.* The artifact coordinates in the form of _groupId:artifactId:type[:classifier]_
 
+* `version`: *Optional.* A regular expression matching the entire version of an artifact. If specified only versions matching the regex will be considered. For example `1\.\0\.0-.*` would match all version like `1.0.0-build.123` but not `1.0.0` or `21.0.0-build.123`. Can be used to pin to latest of a major or minor release without bumping to the absolute latest release.
+
 * `username`: *Optional.* Username for accessing an authenticated repository.
 
 * `password`: *Optional.* Password for accessing an authenticated repository.
@@ -47,6 +49,11 @@ the repository.
 
 Download the artifact from the repository.
 
+### Files
+
+ * (artifact): Named artifact file.
+
+ * version: File containing the version of the artifact.
 
 ### `out`: Deploy artifact to a repository.
 
diff --git a/assets/check b/assets/check
index 26f9ddc..44c0fb8 100755
--- a/assets/check
+++ b/assets/check
@@ -28,6 +28,7 @@ fi
 release_url=$(jq -r '.source.url //empty' < $payload)
 snapshot_url=$(jq -r '.source.snapshot_url //empty' < $payload)
 artifact=$(jq -r '.source.artifact //empty' < $payload)
+version_pattern=$(jq -r '.source.version //".*"' < $payload)
 version=$(jq -r '.version.version //empty' < $payload)
 username=$(jq -r '.source.username //empty' < $payload)
 password=$(jq -r '.source.password //empty' < $payload)
@@ -72,38 +73,31 @@ else
   metadataUrl="$url/${groupId//.//}/$artifactId/maven-metadata.xml"
 fi
 
+metadata=$(mktemp)
 set +e
-metadata=$(curl --fail --silent --show-error $cert $auth $metadataUrl 2>&1)
+curl -o $metadata --fail --silent --show-error $cert $auth $metadataUrl 2>&1
 if [ $? -ne 0 ]; then
-  printf '\e[91m[ERROR]\e[0m %s\n' "$metadata"
+  printf '\e[91m[ERROR]\e[0m %s\n' "$(cat $metadata)"
   printf '\e[91m[ERROR]\e[0m failed to download maven-metadata.xml from: %s\n' "$metadataUrl"
   exit 2
 fi
 set -e
 
-declare -a versions=( )
 if [[ "$version" = *-SNAPSHOT ]]; then
-  if [[ -z "$classifier" ]]; then 
-    versions[1]=$(echo $metadata | xmllint --xpath "/metadata/versioning/snapshotVersions/snapshotVersion[extension='$packaging' and not(classifier)]/value/text()" - 2>/dev/null)
+  if [[ -z "$classifier" ]]; then
+    versions=$(echo "/metadata/versioning/snapshotVersions/snapshotVersion[extension='$packaging' and not(classifier)]/value/text()" | xqilla -i $metadata /dev/stdin 2>/dev/null)
   else
-    versions[1]=$(echo $metadata | xmllint --xpath "/metadata/versioning/snapshotVersions/snapshotVersion[extension='$packaging' and classifier='$classifier']/value/text()" - 2>/dev/null)
+    versions=$(echo "/metadata/versioning/snapshotVersions/snapshotVersion[extension='$packaging' and classifier='$classifier']/value/text()" | xqilla -i $metadata /dev/stdin 2>/dev/null)
   fi
-elif [ "$version" = "latest" ] || [ -z "$version" ]; then
-  versions[1]=$(echo $metadata | xmllint --xpath "/metadata/versioning/versions/version[last()]/text()" - 2>/dev/null)
 else
-  itemsCount=$(echo $metadata | xmllint --xpath 'count(/metadata/versioning/versions/version)' - 2>/dev/null)
-  found=false
-  for (( i=1; i <= $itemsCount; i++ )); do
-
-    current=$(echo $metadata | xmllint --xpath "/metadata/versioning/versions/version[$i]/text()" - 2>/dev/null)
-    if [ "$found" = false ] && [ "$current" = "$version" ]; then
-      found=true
-    fi
-
-    if [ "$found" = true ]; then
-      versions[$i]=$current
-    fi
-  done
+  match_version_pattern="matches(text(), '^$version_pattern\$')"
+  versions=$(echo "/metadata/versioning/versions/((version[text()='$version']/(self::version|following-sibling::version)[$match_version_pattern])|(version[$match_version_pattern][last()]))/text()" | xqilla -i $metadata /dev/stdin 2>/dev/null)
 fi
 
-printf "%s\n" "${versions[@]}" | sed 's/.*/{ "version": "&" }/' | jq --slurp . >&3
+rm -f $metadata
+
+if [ -z "${versions}" ]; then
+  echo "[]" >&3
+else
+  echo "$versions" | sed 's/.*/{ "version": "&" }/' | jq --slurp . >&3
+fi
diff --git a/assets/in b/assets/in
index 1327a49..9f6d7c2 100755
--- a/assets/in
+++ b/assets/in
@@ -101,6 +101,8 @@ args="$args -Drepository.url=$url"
 
 $resource_dir/mvnw dependency:copy $args
 
+echo $version > $destination/version
+
 jq -n \
 --arg version "$version" \
 '{
diff --git a/test/check.sh b/test/check.sh
index a4da733..62c7778 100755
--- a/test/check.sh
+++ b/test/check.sh
@@ -95,7 +95,162 @@ it_can_check_latest_from_three_versions() {
   '
 }
 
+it_can_check_filtered_version_from_four_versions() {
+
+  local src=$(mktemp -d $TMPDIR/check-src.XXXXXX)
+
+  local repository=$src/remote-repository
+  mkdir -p $repository
+
+  local url=file://$repository
+  local artifact=ci.concourse.maven:maven-resource:jar:standalone
+
+  local version1=$(deploy_artifact $url $artifact '1.0.0-rc.1' $src)
+  local version2=$(deploy_artifact $url $artifact '1.0.0-rc.2' $src)
+  local version3=$(deploy_artifact $url $artifact '2.0.0-rc.1' $src)
+  local version4=$(deploy_artifact $url $artifact '21.0.0-rc.1' $src)
+
+  check_artifact_filtered $url $artifact 'latest' $src '1\.0\.0-.*' | \
+  jq -e \
+  --arg version $version2 \
+  '
+    . == [
+      {version: $version}
+    ]
+  '
+}
+
+it_can_check_filtered_version_from_five_versions_interleaved() {
+
+  local src=$(mktemp -d $TMPDIR/check-src.XXXXXX)
+
+  local repository=$src/remote-repository
+  mkdir -p $repository
+
+  local url=file://$repository
+  local artifact=ci.concourse.maven:maven-resource:jar:standalone
+
+  local version1=$(deploy_artifact $url $artifact '1.0.0-rc.1' $src)
+  local version2=$(deploy_artifact $url $artifact '1.0.0-rc.2' $src)
+  local version3=$(deploy_artifact $url $artifact '2.0.0-rc.1' $src)
+  local version4=$(deploy_artifact $url $artifact '21.0.0-rc.1' $src)
+  local version5=$(deploy_artifact $url $artifact '1.0.0-rc.3' $src)
+
+  check_artifact_filtered $url $artifact 'latest' $src '1\.0\.0-.*' | \
+  jq -e \
+  --arg version $version5 \
+  '
+    . == [
+      {version: $version}
+    ]
+  '
+}
+
+it_can_check_filtered_out_all_version() {
+
+  local src=$(mktemp -d $TMPDIR/check-src.XXXXXX)
+
+  local repository=$src/remote-repository
+  mkdir -p $repository
+
+  local url=file://$repository
+  local artifact=ci.concourse.maven:maven-resource:jar:standalone
+
+  local version1=$(deploy_artifact $url $artifact '1.0.0-rc.1' $src)
+  local version2=$(deploy_artifact $url $artifact '1.0.0-rc.2' $src)
+
+  check_artifact_filtered $url $artifact 'latest' $src '2\.0\.0-.*' | \
+  jq -e \
+  '
+    . == [
+    ]
+  '
+}
+
+it_can_check_provided_version_is_not_latest_version_when_filtering() {
+
+  local src=$(mktemp -d $TMPDIR/check-src.XXXXXX)
+
+  local repository=$src/remote-repository
+  mkdir -p $repository
+
+  local url=file://$repository
+  local artifact=ci.concourse.maven:maven-resource:jar:standalone
+
+  local version1=$(deploy_artifact $url $artifact '1.0.0-rc.1' $src)
+  local version2=$(deploy_artifact $url $artifact '1.0.0-rc.2' $src)
+  local version3=$(deploy_artifact $url $artifact '1.0.0-rc.3' $src)
+
+  check_artifact_filtered $url $artifact $version2 $src '1\.0\.0-.*' | \
+  jq -e \
+  --arg version1 $version1 \
+  --arg version2 $version2 \
+  --arg version3 $version3 \
+  '
+    . == [
+      {version: $version2},
+      {version: $version3}
+    ]
+  '
+}
+
+it_can_check_provided_version_is_latest_version_when_filtering() {
+
+  local src=$(mktemp -d $TMPDIR/check-src.XXXXXX)
+
+  local repository=$src/remote-repository
+  mkdir -p $repository
+
+  local url=file://$repository
+  local artifact=ci.concourse.maven:maven-resource:jar:standalone
+
+  local version1=$(deploy_artifact $url $artifact '1.0.0-rc.1' $src)
+  local version2=$(deploy_artifact $url $artifact '1.0.0-rc.2' $src)
+
+  check_artifact_filtered $url $artifact $version2 $src '1\.0\.0-.*' | \
+  jq -e \
+  --arg version1 $version1 \
+  --arg version2 $version2 \
+  '
+    . == [
+      {version: $version2}
+    ]
+  '
+}
+
+it_can_check_filtered_version_gets_latest_version_if_input_version_is_missing() {
+
+  local src=$(mktemp -d $TMPDIR/check-src.XXXXXX)
+
+  local repository=$src/remote-repository
+  mkdir -p $repository
+
+  local url=file://$repository
+  local artifact=ci.concourse.maven:maven-resource:jar:standalone
+
+  local version1=$(deploy_artifact $url $artifact '1.0.0-rc.1' $src)
+  local version2=$(deploy_artifact $url $artifact '1.0.0-rc.2' $src)
+  local version3=$(deploy_artifact $url $artifact '2.0.0-rc.1' $src)
+  local version4=$(deploy_artifact $url $artifact '21.0.0-rc.1' $src)
+  local version5=$(deploy_artifact $url $artifact '1.0.0-rc.4' $src)
+
+  check_artifact_filtered $url $artifact '1.0.0-rc.3' $src '1\.0\.0-.*' | \
+  jq -e \
+  --arg version $version5 \
+  '
+    . == [
+      {version: $version}
+    ]
+  '
+}
+
 run it_can_check_from_one_version
 run it_can_check_from_three_versions
 run it_can_check_latest_from_one_version
 run it_can_check_latest_from_three_versions
+run it_can_check_filtered_version_from_four_versions
+run it_can_check_filtered_version_from_five_versions_interleaved
+run it_can_check_filtered_out_all_version
+run it_can_check_provided_version_is_not_latest_version_when_filtering
+run it_can_check_provided_version_is_latest_version_when_filtering
+run it_can_check_filtered_version_gets_latest_version_if_input_version_is_missing
diff --git a/test/get.sh b/test/get.sh
index 1327e14..a2c656f 100755
--- a/test/get.sh
+++ b/test/get.sh
@@ -22,6 +22,8 @@ it_can_get_artifact() {
   '
     .version == {version: $version}
   '
+  local actual_version=$(cat $src/version)
+  [ "$version" == "$actual_version" ]
 }
 
 run it_can_get_artifact
diff --git a/test/helpers.sh b/test/helpers.sh
index f5afa8b..0940bea 100755
--- a/test/helpers.sh
+++ b/test/helpers.sh
@@ -154,6 +154,30 @@ check_artifact() {
   }' | $resource_dir/check "$src" | tee /dev/stderr
 }
 
+check_artifact_filtered() {
+  local url=$1
+  local artifact=$2
+  local version=$3
+  local src=$4
+  local filter=$5
+
+  jq -n \
+  --arg url "$url" \
+  --arg artifact "$artifact" \
+  --arg version "$version" \
+  --arg filter "$filter" \
+  '{
+    source: {
+      url: $url,
+      artifact: $artifact,
+      version: $filter
+    },
+    version: {
+      version: $version
+    }
+  }' | $resource_dir/check "$src" | tee /dev/stderr
+}
+
 check_artifact_from_manager() {
 
   local version=$1