diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 29dcfe26..615e9583 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -9,7 +9,7 @@ on:
         type: string
         description: 'Stringified JSON object listing go versions'
         default: >-
-          ["1.25.12"]
+          ["1.26.8"]
       privilege-level:
         required: false
         type: string
@@ -55,12 +55,15 @@ jobs:
     name: "Build platform ${{ matrix.platform }} golang ${{ matrix.go-version }} privilege ${{ matrix.privilege-level }}"
     steps:
       - uses: actions/checkout@v7
+        with:
+          fetch-tags: true
+          fetch-depth: 0
       - name: Clean disk space
         uses: ./.github/actions/clean-runner
       - uses: benjlevesque/short-sha@v4.0
         id: short-sha
       - name: Set up golang ${{ matrix.go-version }}
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ matrix.go-version }}
       - name: Setup Environment
@@ -89,13 +92,13 @@ jobs:
       - name: Build-level1
         run: |
           make show-info
-          make stacker-dynamic VERSION_FULL=${{ inputs.build-id }}
+          make stacker-dynamic BUILD_ID=${{ inputs.build-id }}
       - name: Lint
         run: |
           make lint
       - name: Build
         run: |
-          make stacker VERSION_FULL=${{ inputs.build-id }}
+          make stacker BUILD_ID=${{ inputs.build-id }}
         env:
           REGISTRY_SERVICE: ${{ inputs.registry-service }}
           REGISTRY_URL: localhost:5000
@@ -106,7 +109,7 @@ jobs:
         uses: ./.github/actions/show-disk-usage
       - name: Test
         run: |
-          make check VERSION_FULL=${{ inputs.build-id }} PRIVILEGE_LEVEL=${{ matrix.privilege-level }}
+          make check BUILD_ID=${{ inputs.build-id }} PRIVILEGE_LEVEL=${{ matrix.privilege-level }}
         env:
           REGISTRY_SERVICE: ${{ inputs.registry-service }}
           REGISTRY_URL: localhost:5000
diff --git a/.github/workflows/cloc.yml b/.github/workflows/cloc.yml
index 5786f210..07e5d107 100644
--- a/.github/workflows/cloc.yml
+++ b/.github/workflows/cloc.yml
@@ -18,11 +18,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Install go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
-          go-version: 1.25.12
+          go-version: 1.26.8
       - name: Check out source code
         uses: actions/checkout@v7
+        with:
+          fetch-tags: true
+          fetch-depth: 0
       - name: Install dependencies
         run: |
           cd $GITHUB_WORKSPACE
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 0bf728df..dd921444 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -44,11 +44,14 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v7
+      with:
+        fetch-tags: true
+        fetch-depth: 0
 
     - name: Install go
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@v7
       with:
-        go-version: 1.25.12
+        go-version: 1.26.8
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/commit-msg.yaml b/.github/workflows/commit-msg.yaml
index 3cc5ba30..f6500921 100644
--- a/.github/workflows/commit-msg.yaml
+++ b/.github/workflows/commit-msg.yaml
@@ -17,6 +17,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          fetch-tags: true
+          fetch-depth: 0
       - name: Check Commit Type
         uses: gsactions/commit-message-checker@v2
         with:
diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml
index be7dfa12..15d153ff 100644
--- a/.github/workflows/coverage.yaml
+++ b/.github/workflows/coverage.yaml
@@ -9,7 +9,7 @@ on:
         type: string
         description: 'Stringified JSON object listing go versions'
         default: >-
-          ["1.25.12"]
+          ["1.26.8"]
       privilege-level:
         required: false
         type: string
@@ -51,12 +51,15 @@ jobs:
     name: "golang ${{ matrix.go-version }} privilege ${{ matrix.privilege-level }}"
     steps:
       - uses: actions/checkout@v7
+        with:
+          fetch-tags: true
+          fetch-depth: 0
       - name: Clean disk space
         uses: ./.github/actions/clean-runner
       - uses: benjlevesque/short-sha@v4.0
         id: short-sha
       - name: Set up golang ${{ matrix.go-version }}
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ matrix.go-version }}
       - name: Setup Environment
@@ -86,7 +89,7 @@ jobs:
       - name: Build-level1
         run: |
           make show-info
-          make stacker-dynamic VERSION_FULL=${{ inputs.build-id }}
+          make stacker-dynamic BUILD_ID=${{ inputs.build-id }}
       - name: Show disk usage before running the tests
         if: always()
         uses: ./.github/actions/show-disk-usage
diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
index dd515645..79443e69 100644
--- a/.github/workflows/dco.yml
+++ b/.github/workflows/dco.yml
@@ -12,8 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
+      with:
+        fetch-tags: true
+        fetch-depth: 0
     - name: Set up Python 3.x
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: '3.x'
     - name: Check DCO
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index edecaf27..a3aae325 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -12,6 +12,9 @@ jobs:
       build-id: ${{steps.build-id.outputs.build-id}}
     steps:
       - uses: actions/checkout@v7
+        with:
+          fetch-tags: true
+          fetch-depth: 0
       - uses: benjlevesque/short-sha@v4.0
         id: short-sha
       - id: build-id
diff --git a/Makefile b/Makefile
index b1e2f7df..f92d36b6 100644
--- a/Makefile
+++ b/Makefile
@@ -7,8 +7,9 @@ export GOCACHE ?= $(GOPATH)/gocache
 GO_SRC=$(shell find pkg cmd -name \*.go)
 GOARCH=$(shell go env GOARCH)
 GOOS=$(shell go env GOOS)
-VERSION?=$(shell git describe --tags || git rev-parse HEAD)
-VERSION_FULL?=$(if $(shell git status --porcelain --untracked-files=no),$(VERSION)-dirty,$(VERSION))
+# --tags includes both annotated and lightweight tags but must match our expected versioning
+VERSION?=$(shell git describe --tags --always --long --dirty --match 'v[0-9]*.[0-9]*.[0-9]*' 2>/dev/null || echo 'no-git')
+BUILD_ID?=$(shell git rev-parse --short HEAD || echo 'no-git')
 HASH = \#
 
 LXC_VERSION?=$(shell pkg-config --modversion lxc)
@@ -17,7 +18,7 @@ BUILD_TAGS = exclude_graphdriver_btrfs exclude_graphdriver_devicemapper containe
 
 STACKER_OPTS=--oci-dir=$(BUILD_D)/oci --roots-dir=$(BUILD_D)/roots --stacker-dir=$(BUILD_D)/stacker --storage-type=overlay
 
-VERSION_LDFLAGS=-X stackerbuild.io/stacker/pkg/lib.StackerVersion=$(VERSION_FULL) -X stackerbuild.io/stacker/pkg/lib.LXCVersion=$(LXC_VERSION)
+VERSION_LDFLAGS=-X stackerbuild.io/stacker/pkg/lib.StackerVersion=$(VERSION) -X stackerbuild.io/stacker/pkg/lib.LXCVersion=$(LXC_VERSION)
 build_stacker = go build $1 -tags "$(BUILD_TAGS) $2" -ldflags "$(VERSION_LDFLAGS) $3" -o $4 ./cmd/stacker
 
 # See doc/hacking.md for how to use a local oci or docker repository.
@@ -46,7 +47,8 @@ REGCLIENT_VERSION := v0.5.1
 SKOPEO = $(TOOLS_D)/bin/skopeo
 export SKOPEO_VERSION = 1.13.0
 BATS = $(TOOLS_D)/bin/bats
-BATS_VERSION := v1.10.0
+BATS_VERSION := v1.13.0
+BATS_VERSION_STAMP := $(TOOLS_D)/.bats-$(BATS_VERSION)
 # OCI registry
 ZOT := $(TOOLS_D)/bin/zot
 ZOT_VERSION := v2.1.8
@@ -55,16 +57,21 @@ UMOCI_VERSION := main
 
 export PATH := $(TOOLS_D)/bin:$(PATH)
 
-GOLANGCI_LINT_VERSION = 2.7.2
+GOLANGCI_LINT_VERSION = 2.13.1
 GOLANGCI_LINT_URL = https://github.com/golangci/golangci-lint/releases/download
 GOLANGCI_LINT = $(TOOLS_D)/bin/golangci-lint
 
 STAGE1_STACKER ?= ./stacker-dynamic
-STACKER_PUBLISH_BIN := stacker-$(GOOS)-$(GOARCH)
+LXC_WRAPPER_DYNAMIC = cmd/stacker/lxc-wrapper/lxc-wrapper-host
+LXC_WRAPPER_STATIC = cmd/stacker/lxc-wrapper/lxc-wrapper-static
+LINT = $(BUILD_D)/lint
+GO_TEST = $(BUILD_D)/go-test
 
 STACKER_DEPS = $(GO_SRC) go.mod go.sum
+STACKER_DYNAMIC_DEPS = $(GO_TEST) $(STACKER_DEPS) $(LXC_WRAPPER_DYNAMIC)
+STACKER_STATIC_DEPS = $(STACKER_DEPS) $(LXC_WRAPPER_STATIC)
 
-stacker: $(STAGE1_STACKER) $(STACKER_DEPS) cmd/stacker/lxc-wrapper/lxc-wrapper.c
+stacker: $(STAGE1_STACKER) build.yaml
 	echo STACKER_DOCKER_BASE=$(STACKER_DOCKER_BASE)
 	echo STACKER_BUILD_BASE_IMAGE=$(STACKER_BUILD_BASE_IMAGE)
 	$(STAGE1_STACKER) --debug $(STACKER_OPTS) build \
@@ -73,28 +80,30 @@ stacker: $(STAGE1_STACKER) $(STACKER_DEPS) cmd/stacker/lxc-wrapper/lxc-wrapper.c
 		--substitute STACKER_BUILD_BASE_IMAGE=$(STACKER_BUILD_BASE_IMAGE) \
 		--substitute LXC_CLONE_URL=$(LXC_CLONE_URL) \
 		--substitute LXC_BRANCH=$(LXC_BRANCH) \
-		--substitute VERSION_FULL=$(VERSION_FULL) \
+		--substitute VERSION=$(VERSION) \
 		--substitute WITH_COV=no
 
-stacker-cov: $(STAGE1_STACKER) $(STACKER_DEPS) cmd/stacker/lxc-wrapper/lxc-wrapper.c
+stacker-cov: $(STAGE1_STACKER) build.yaml
 	$(STAGE1_STACKER) --debug $(STACKER_OPTS) build \
 		-f build.yaml \
 		--substitute BUILD_D=$(BUILD_D) \
 		--substitute STACKER_BUILD_BASE_IMAGE=$(STACKER_BUILD_BASE_IMAGE) \
 		--substitute LXC_CLONE_URL=$(LXC_CLONE_URL) \
 		--substitute LXC_BRANCH=$(LXC_BRANCH) \
-		--substitute VERSION_FULL=$(VERSION_FULL) \
+		--substitute VERSION=$(VERSION) \
 		--substitute WITH_COV=yes
 
 .PHONY: publish-stacker-bin
-publish-stacker-bin: $(STACKER_PUBLISH_BIN)
-
-$(STACKER_PUBLISH_BIN): stacker
-	cp -v $< $@
+publish-stacker-bin: stacker
+	cp -v $< stacker-$$(go env GOOS)-$$(go env GOARCH)
 
 # On Ubuntu 24.04 the lxc package does not link against libsystemd so the pkg-config
 # below does list -lsystemd; we must add it to the list but only for stacker-dynamic
-ifeq ($(shell awk -F= '/VERSION_ID/ {print $$2}' /etc/os-release),"24.04")
+OS_VERSION_ID ?= "24.04"
+ifneq (,$(wildcard /etc/os-release))
+OS_VERSION_ID := $(shell awk -F= '/VERSION_ID/ {print $$2}' /etc/os-release)
+endif
+ifeq ($(OS_VERSION_ID),"24.04")
 ifeq (stacker-dynamic,$(firstword $(MAKECMDGOALS)))
 LXC_WRAPPER_LIBS=-lsystemd
 else
@@ -102,38 +111,42 @@ LXC_WRAPPER_LIBS=
 endif
 endif
 
-stacker-static: $(STACKER_DEPS) cmd/stacker/lxc-wrapper/lxc-wrapper
+stacker-static: $(STACKER_STATIC_DEPS)
 	$(call build_stacker,,static_build,-extldflags '-static',stacker)
 
 # can't use a comma in func call args, so do this instead
 , := ,
-stacker-static-cov: $(GO_SRC) go.mod go.sum cmd/stacker/lxc-wrapper/lxc-wrapper
+stacker-static-cov: $(STACKER_STATIC_DEPS)
 	$(call build_stacker,-cover -coverpkg="./pkg/...$(,)./cmd/...",static_build,-extldflags '-static',stacker)
 
-# TODO: because we clean lxc-wrapper in the nested build, this always rebuilds.
-# Could find a better way to do this.
-stacker-dynamic: $(STACKER_DEPS) cmd/stacker/lxc-wrapper/lxc-wrapper
+stacker-dynamic: $(STACKER_DYNAMIC_DEPS)
 	$(call build_stacker,,,,stacker-dynamic)
 
-cmd/stacker/lxc-wrapper/lxc-wrapper: cmd/stacker/lxc-wrapper/lxc-wrapper.c
-	make -C cmd/stacker/lxc-wrapper LDFLAGS=-static LDLIBS="$(shell pkg-config --static --libs lxc) $(LXC_WRAPPER_LIBS) -lpthread -ldl" lxc-wrapper
+$(LXC_WRAPPER_DYNAMIC) $(LXC_WRAPPER_STATIC): cmd/stacker/lxc-wrapper/lxc-wrapper.c
+	make -C cmd/stacker/lxc-wrapper OUTPUT=$(notdir $@) LDFLAGS=-static LDLIBS="$(shell pkg-config --static --libs lxc) $(LXC_WRAPPER_LIBS) -lpthread -ldl"
 
 
 .PHONY: go-download
 go-download:
 	go mod download
 
-.PHONY: lint
-lint: $(GO_SRC) $(GOLANGCI_LINT)
+lint: $(LINT)
+
+$(LINT): $(GO_SRC) go.mod go.sum $(GOLANGCI_LINT)
 	go mod tidy
 	go fmt ./... && ([ -z $(CI) ] || git diff --exit-code)
 	bash test/static-analysis.sh
 	$(GOLANGCI_LINT) run --build-tags "$(BUILD_TAGS) skipembed"
+	@mkdir -p $(dir $@)
+	@touch $@
+
+go-test: $(GO_TEST)
 
-.PHONY: go-test
-go-test:
+$(GO_TEST): $(LINT) $(GO_SRC) go.mod go.sum
 	go test -v -trimpath -cover -coverprofile=coverage.txt -covermode=atomic -tags "exclude_graphdriver_btrfs exclude_graphdriver_devicemapper containers_image_openpgp osusergo netgo skipembed" ./pkg/... ./cmd/...
 	go tool cover -html coverage.txt  -o $(HACK_D)/coverage.html
+	@mkdir -p $(dir $@)
+	@touch $@
 
 .PHONY: download-tools
 download-tools: $(GOLANGCI_LINT) $(REGCLIENT) $(ZOT) $(BATS) $(UMOCI) $(SKOPEO)
@@ -170,7 +183,9 @@ $(SKOPEO):
 	cd $(TOP_LEVEL); \
 	rm -rf $$tmpdir;
 
-$(BATS):
+$(BATS): $(BATS_VERSION_STAMP)
+
+$(BATS_VERSION_STAMP):
 	mkdir -p $(TOOLS_D)/bin
 	rm -rf bats-core
 	git clone -b $(BATS_VERSION) https://github.com/bats-core/bats-core.git
@@ -180,6 +195,7 @@ $(BATS):
 	git clone --depth 1 https://github.com/bats-core/bats-support $(TOP_LEVEL)/test/test_helper/bats-support
 	git clone --depth 1 https://github.com/bats-core/bats-assert $(TOP_LEVEL)/test/test_helper/bats-assert
 	git clone --depth 1 https://github.com/bats-core/bats-file $(TOP_LEVEL)/test/test_helper/bats-file
+	touch $@
 
 
 $(UMOCI):
@@ -195,7 +211,9 @@ PRIVILEGE_LEVEL ?= unpriv
 # make check TEST=basic will run only the basic test
 # make check PRIVILEGE_LEVEL=unpriv will run only unprivileged tests
 .PHONY: check
-check: lint test go-test
+check:
+	$(MAKE) go-test
+	$(MAKE) test
 
 .PHONY: test
 test: stacker download-tools lintbats
@@ -205,8 +223,8 @@ test: stacker download-tools lintbats
 		STACKER_BUILD_CENTOS_IMAGE=$(STACKER_BUILD_CENTOS_IMAGE) \
 		STACKER_BUILD_UBUNTU_IMAGE=$(STACKER_BUILD_UBUNTU_IMAGE) \
 		TOP_LEVEL=$(TOP_LEVEL) \
+		BUILD_ID=$(BUILD_ID) \
 		VERSION=$(VERSION) \
-		VERSION_FULL=$(VERSION_FULL) \
 		./test/main.py \
 		$(shell [ -z $(PRIVILEGE_LEVEL) ] || echo --privilege-level=$(PRIVILEGE_LEVEL)) \
 		$(patsubst %,test/%.bats,$(TEST))
@@ -230,8 +248,8 @@ test-cov: stacker-cov download-tools
 		STACKER_BUILD_CENTOS_IMAGE=$(STACKER_BUILD_CENTOS_IMAGE) \
 		STACKER_BUILD_UBUNTU_IMAGE=$(STACKER_BUILD_UBUNTU_IMAGE) \
 		TOP_LEVEL=$(TOP_LEVEL) \
+		BUILD_ID=$(BUILD_ID) \
 		VERSION=$(VERSION) \
-		VERSION_FULL=$(VERSION_FULL) \
 		./test/main.py \
 		$(shell [ -z $(PRIVILEGE_LEVEL) ] || echo --privilege-level=$(PRIVILEGE_LEVEL)) \
 		$(patsubst %,test/%.bats,$(TEST))
@@ -245,6 +263,9 @@ docker-clone: $(SKOPEO)
 .PHONY: show-info
 show-info:
 	@echo BUILD_D=$(BUILD_D)
+	@echo BUILD_ID=$(BUILD_ID)
+	@echo VERSION=$(VERSION)
+	@echo TOP_LEVEL=$(TOP_LEVEL)
 	@go env
 
 .PHONY: vendorup
@@ -255,12 +276,11 @@ vendorup:
 .PHONY: debug
 debug:
 	@echo TOP_LEVEL=$(TOP_LEVEL)
+	@echo BUILD_ID=$(BUILD_ID)
 	@echo VERSION=$(VERSION)
-	@echo VERSION_FULL=$(VERSION_FULL)
 
 .PHONY: clean
 clean:
-	-unshare -Urm rm -rf stacker stacker-dynamic .build
+	-unshare -Urm rm -rf ./stacker ./stacker-dynamic ./stacker-*-* ./.build ./.stacker ./oci ./roots ./stackertest-* ./coverage.txt ./hack ./bats-core
 	-rm -rf ./test/centos ./test/ubuntu ./test/busybox ./test/alpine ./test/test_helper
 	-make -C cmd/stacker/lxc-wrapper clean
-	-rm -rf $(TOOLS_D)
diff --git a/build.yaml b/build.yaml
index c8f40daf..1a893410 100644
--- a/build.yaml
+++ b/build.yaml
@@ -88,7 +88,7 @@ build:
     # golang wants somewhere to put its garbage
     export HOME=/root
     export LXC_VERSION=$(git -C /lxc rev-parse HEAD)
-    export VERSION_FULL=${{VERSION_FULL}}
+    export VERSION=${{VERSION}}
 
     # apk go pkg doesn't seem to have the standard go.env which would set GOTOOLCHAIN=auto.
     # therefore it defaults to 'local', which ignores the `toolchain` line in go.mod
@@ -97,9 +97,10 @@ build:
 
     cd /stacker-tree
     make BUILD_D=/build show-info
-    make BUILD_D=/build -C cmd/stacker/lxc-wrapper clean
+    # -B rebuilds the static wrapper for this build environment without
+    # cleaning the host wrapper used by stacker-dynamic.
     if [ x${{WITH_COV}} = x"yes" ]; then
-      make BUILD_D=/build stacker-static-cov
+      make -B BUILD_D=/build stacker-static-cov
     else
-      make -C /stacker-tree stacker-static
+      make -B -C /stacker-tree stacker-static
     fi
diff --git a/cmd/stacker/lxc-wrapper/.gitignore b/cmd/stacker/lxc-wrapper/.gitignore
index c4cb619f..d8548793 100644
--- a/cmd/stacker/lxc-wrapper/.gitignore
+++ b/cmd/stacker/lxc-wrapper/.gitignore
@@ -1 +1 @@
-lxc-wrapper
+lxc-wrapper*
diff --git a/cmd/stacker/lxc-wrapper/Makefile b/cmd/stacker/lxc-wrapper/Makefile
index 15fba8f0..e88c3946 100644
--- a/cmd/stacker/lxc-wrapper/Makefile
+++ b/cmd/stacker/lxc-wrapper/Makefile
@@ -1,2 +1,8 @@
+OUTPUT ?= lxc-wrapper
+
+$(OUTPUT): lxc-wrapper.c
+	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ $< $(LDLIBS)
+
+.PHONY: clean
 clean:
-	-rm lxc-wrapper
+	-rm -f lxc-wrapper lxc-wrapper-host lxc-wrapper-static
diff --git a/cmd/stacker/main.go b/cmd/stacker/main.go
index 9d2a8a9d..454c3b06 100644
--- a/cmd/stacker/main.go
+++ b/cmd/stacker/main.go
@@ -257,6 +257,7 @@ func main() {
 		}
 
 		config.EmbeddedFS = embeddedFS
+		config.EmbeddedWrapperPath = embeddedWrapperPath
 
 		if config.WorkDir == "" || ctx.IsSet("work-dir") {
 			config.WorkDir = ctx.String("work-dir")
diff --git a/cmd/stacker/main_embed.go b/cmd/stacker/main_embed.go
index 8108c423..1e38ff45 100644
--- a/cmd/stacker/main_embed.go
+++ b/cmd/stacker/main_embed.go
@@ -1,10 +1,11 @@
-//go:build !skipembed
+//go:build !skipembed && !static_build
 
 package main
 
 import "embed"
 
-//go:embed lxc-wrapper/lxc-wrapper
+//go:embed lxc-wrapper/lxc-wrapper-host
 var embeddedFS embed.FS
 
 const hasEmbedded = true
+const embeddedWrapperPath = "lxc-wrapper/lxc-wrapper-host"
diff --git a/cmd/stacker/main_embed_static.go b/cmd/stacker/main_embed_static.go
new file mode 100644
index 00000000..37ab7e87
--- /dev/null
+++ b/cmd/stacker/main_embed_static.go
@@ -0,0 +1,11 @@
+//go:build !skipembed && static_build
+
+package main
+
+import "embed"
+
+//go:embed lxc-wrapper/lxc-wrapper-static
+var embeddedFS embed.FS
+
+const hasEmbedded = true
+const embeddedWrapperPath = "lxc-wrapper/lxc-wrapper-static"
diff --git a/cmd/stacker/main_noembed.go b/cmd/stacker/main_noembed.go
index 2790c3ea..4ad0621f 100644
--- a/cmd/stacker/main_noembed.go
+++ b/cmd/stacker/main_noembed.go
@@ -7,3 +7,4 @@ import "embed"
 var embeddedFS embed.FS
 
 const hasEmbedded = true
+const embeddedWrapperPath = ""
diff --git a/go.mod b/go.mod
index eaedd2d8..7aa008dd 100644
--- a/go.mod
+++ b/go.mod
@@ -1,33 +1,33 @@
 module stackerbuild.io/stacker
 
-go 1.25.12
+go 1.26.8
 
 require (
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	github.com/apex/log v1.9.0
 	github.com/apparentlymart/go-shquot v0.0.1
-	github.com/cheggaaa/pb/v3 v3.1.7
+	github.com/cheggaaa/pb/v3 v3.2.1
 	github.com/dustin/go-humanize v1.0.1
 	github.com/google/uuid v1.6.0
 	github.com/justincormack/go-memfd v0.0.0-20170219213707-6e4af0518993
 	github.com/klauspost/pgzip v1.2.6
 	github.com/lxc/go-lxc v0.0.0-20260316180011-3af4ce000ed7
-	github.com/lxc/incus/v7 v7.2.0
+	github.com/lxc/incus/v7 v7.4.0
 	github.com/minio/sha256-simd v1.0.1
 	github.com/mitchellh/hashstructure v1.1.0
-	github.com/moby/buildkit v0.31.1
+	github.com/moby/buildkit v0.32.2
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/opencontainers/umoci v0.6.1-0.20251213054154-70fc5ee1f4df
 	github.com/pkg/errors v0.9.1
 	github.com/pkg/xattr v0.4.12
 	github.com/smartystreets/goconvey v1.8.1
-	github.com/stretchr/testify v1.11.1
+	github.com/stretchr/testify v1.12.1
 	github.com/twmb/algoimpl v0.0.0-20170717182524-076353e90b94
 	github.com/udhos/equalfile v0.3.0
 	github.com/urfave/cli/v2 v2.27.7
 	github.com/vbatts/go-mtree v0.7.0
-	go.podman.io/image/v5 v5.40.0
+	go.podman.io/image/v5 v5.41.1
 	golang.org/x/sys v0.47.0
 	golang.org/x/term v0.45.0
 	gopkg.in/yaml.v2 v2.4.0
@@ -37,102 +37,103 @@ require (
 require (
 	cyphar.com/go-pathrs v0.2.5 // indirect
 	github.com/Masterminds/semver/v3 v3.3.1 // indirect
+	github.com/ProtonMail/go-crypto v1.4.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/platforms v1.0.0-rc.4 // indirect
+	github.com/containerd/platforms v1.0.0-rc.5 // indirect
 	github.com/cyphar/filepath-securejoin v0.7.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/freddierice/go-losetup v0.0.0-20220711213114-2a14873012db // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/martinjungblut/go-cryptsetup v0.0.0-20220520180014-fd0874fd07a6 // indirect
-	github.com/mattn/go-sqlite3 v1.14.47 // indirect
+	github.com/mattn/go-sqlite3 v1.14.50 // indirect
 	github.com/mistifyio/go-zfs/v4 v4.0.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/moby/api v1.54.2 // indirect
-	github.com/moby/moby/client v0.4.1 // indirect
+	github.com/moby/moby/api v1.55.0 // indirect
+	github.com/moby/moby/client v0.5.1 // indirect
 	github.com/moby/sys/capability v0.4.0 // indirect
 	github.com/moby/sys/user v0.4.1 // indirect
-	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/moby/sys/userns v0.2.0 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/sigstore/protobuf-specs v0.5.1 // indirect
-	github.com/sirupsen/logrus v1.9.4 // indirect
-	github.com/smallstep/pkcs7 v0.1.1 // indirect
+	github.com/sirupsen/logrus v1.10.2 // indirect
+	github.com/smallstep/pkcs7 v0.2.1 // indirect
 	github.com/smarty/assertions v1.15.0 // indirect
 	github.com/tchap/go-patricia/v2 v2.3.3 // indirect
-	github.com/vbauerster/mpb/v8 v8.12.0 // indirect
+	github.com/vbauerster/cupwriter v0.0.4 // indirect
+	github.com/vbauerster/mpb/v8 v8.14.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
-	go.opentelemetry.io/otel v1.44.0 // indirect
-	go.opentelemetry.io/otel/metric v1.44.0 // indirect
-	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	go.opentelemetry.io/otel v1.46.0 // indirect
+	go.opentelemetry.io/otel/metric v1.46.0 // indirect
+	go.opentelemetry.io/otel/trace v1.46.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	go.yaml.in/yaml/v4 v4.0.0-rc.6 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 )
 
 require (
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
 	github.com/BurntSushi/toml v1.6.0 // indirect
-	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // indirect
 	github.com/VividCortex/ewma v1.2.0 // indirect
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
 	github.com/containerd/typeurl/v2 v2.3.0 // indirect
 	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
-	github.com/containers/ocicrypt v1.3.0 // indirect
+	github.com/containers/ocicrypt v1.3.2 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.8 // indirect
-	github.com/docker/go-connections v0.7.0 // indirect
+	github.com/docker/go-connections v0.8.1 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/go-containerregistry v0.21.6 // indirect
+	github.com/google/go-containerregistry v0.21.7 // indirect
 	github.com/google/go-intervals v0.0.2 // indirect
 	github.com/gopherjs/gopherjs v1.17.2 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/jtolds/gls v4.20.0+incompatible // indirect
-	github.com/klauspost/compress v1.18.6 // indirect
+	github.com/klauspost/compress v1.19.2 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/mattn/go-colorable v0.1.15 // indirect
-	github.com/mattn/go-isatty v0.0.22 // indirect
-	github.com/mattn/go-runewidth v0.0.24 // indirect
-	github.com/miekg/pkcs11 v1.1.1 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
+	github.com/mattn/go-runewidth v0.0.28 // indirect
+	github.com/miekg/pkcs11 v1.1.2 // indirect
 	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/opencontainers/runtime-spec v1.3.0 // indirect
 	github.com/opencontainers/selinux v1.15.1 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/proglottis/gpgme v0.1.6 // indirect
 	github.com/rootless-containers/proto/go-proto v0.0.0-20260207013450-f6ee952d53d9 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect
-	github.com/sigstore/fulcio v1.8.5 // indirect
+	github.com/sigstore/fulcio v1.8.7 // indirect
 	github.com/sigstore/sigstore v1.10.8 // indirect
 	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
-	github.com/ulikunitz/xz v0.5.15 // indirect
+	github.com/ulikunitz/xz v0.5.16 // indirect
 	github.com/urfave/cli v1.22.17 // indirect
 	github.com/vbatts/tar-split v0.12.3 // indirect
 	github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 // indirect
-	go.podman.io/storage v1.63.0 // indirect
-	golang.org/x/crypto v0.53.0 // indirect
-	golang.org/x/net v0.56.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d // indirect
-	google.golang.org/grpc v1.81.1 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
+	go.podman.io/storage v1.64.0 // indirect
+	golang.org/x/crypto v0.55.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 // indirect
+	google.golang.org/grpc v1.83.2 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 	machinerun.io/atomfs v1.2.1
 )
 
@@ -153,5 +154,3 @@ replace golang.org/x/crypto => golang.org/x/crypto v0.52.0
 replace golang.org/x/net => golang.org/x/net v0.55.0
 
 replace golang.org/x/text => golang.org/x/text v0.39.0
-
-replace google.golang.org/grpc => google.golang.org/grpc v1.82.1
diff --git a/go.sum b/go.sum
index ac0c9c0f..930ed36a 100644
--- a/go.sum
+++ b/go.sum
@@ -9,8 +9,10 @@ github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk
 github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/Masterminds/semver/v3 v3.3.1 h1:QtNSWtVZ3nBfk8mAOu/B6v7FMJ+NHTIgUPi7rj+4nv4=
 github.com/Masterminds/semver/v3 v3.3.1/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
-github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
-github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 h1:0kQAzHq8vLs7Pptv+7TxjdETLf/nIqJpIB4oC6Ba4vY=
+github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29/go.mod h1:ZWa7ssZJT30CCDGJ7fk/2SBTq9BIQrrVjrcss0UW2s0=
+github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
+github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
 github.com/VividCortex/ewma v1.2.0 h1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=
 github.com/VividCortex/ewma v1.2.0/go.mod h1:nz4BbCtbLyFDeC9SUHbtcT5644juEuWfUAUnGx7j5l4=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
@@ -30,26 +32,28 @@ github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cheggaaa/pb/v3 v3.1.7 h1:2FsIW307kt7A/rz/ZI2lvPO+v3wKazzE4K/0LtTWsOI=
-github.com/cheggaaa/pb/v3 v3.1.7/go.mod h1:/Ji89zfVPeC/u5j8ukD0MBPHt2bzTYp74lQ7KlgFWTQ=
+github.com/cheggaaa/pb/v3 v3.2.1 h1:aprZbFRG+B7+ug76S8QZ6Y1PW168UHzOmbC3wa+aU6I=
+github.com/cheggaaa/pb/v3 v3.2.1/go.mod h1:U9hSVxoKqJrZIE3PkFG1xXXNaK/Ilzg+EF/scpXzEdw=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
+github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
+github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
 github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
 github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/containerd/platforms v1.0.0-rc.4 h1:M42JrUT4zfZTqtkUwkr0GzmUWbfyO5VO0Q5b3op97T4=
-github.com/containerd/platforms v1.0.0-rc.4/go.mod h1:lKlMXyLybmBedS/JJm11uDofzI8L2v0J2ZbYvNsbq1A=
+github.com/containerd/platforms v1.0.0-rc.5 h1:vXd569rDrz8LeMXzAnBsy6LADV5YtsD8oyaRarxdmSU=
+github.com/containerd/platforms v1.0.0-rc.5/go.mod h1:lKlMXyLybmBedS/JJm11uDofzI8L2v0J2ZbYvNsbq1A=
 github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw=
 github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY=
 github.com/containerd/typeurl/v2 v2.3.0 h1:HZHPhRWo5XMy3QGQoPrUzbW/2ckwjfweHmOwlkIrPAQ=
 github.com/containerd/typeurl/v2 v2.3.0/go.mod h1:Qk+PAdUYArVj41TnGi6rJ+48RF0PkcTc4i/taoBcK0w=
 github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 h1:Qzk5C6cYglewc+UyGf6lc8Mj2UaPTHy/iF2De0/77CA=
 github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01/go.mod h1:9rfv8iPl1ZP7aqh9YA68wnZv2NUDbXdcdPHVz0pFbPY=
-github.com/containers/ocicrypt v1.3.0 h1:ps3St6ZWNWhOQ/Kqld6K2wPHt01Mj3AqRTNCZLIWOfo=
-github.com/containers/ocicrypt v1.3.0/go.mod h1:PmfuGFpBwnGLnbqBm+QIy2nc8noDJ1Wt6B19la7VBFo=
+github.com/containers/ocicrypt v1.3.2 h1:MuqHSfiPpGzoAQdgDSX85FgixSgIm9mSDXTLTgugY5E=
+github.com/containers/ocicrypt v1.3.2/go.mod h1:ntBZabYG0rlvstB/1rK/ba2laaU5EHE0pD5ioHoPTq4=
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 h1:uX1JmpONuD549D73r6cgnxyUu18Zb7yHAy5AYU0Pm4Q=
@@ -62,14 +66,14 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v29.5.3+incompatible h1:nbEFfz774vBwQ5KRYv7c/AghjReqnGISvrRhzjV0evs=
-github.com/docker/cli v29.5.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v29.6.2+incompatible h1:/bjePvcbbFTnRrMfWJBY7AjfICdsiLVgHn6LwTVOcqw=
+github.com/docker/cli v29.6.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker-credential-helpers v0.9.8 h1:bIREROb7So6PRlq6KTtdS9MPEjC29OQRkFNlvK2OX8Q=
 github.com/docker/docker-credential-helpers v0.9.8/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
-github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf0mN39c=
-github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
+github.com/docker/go-connections v0.8.1 h1:JibmG5hULs5qXSr/cp/w3Pw5fZuStt4MOHMUExb29/M=
+github.com/docker/go-connections v0.8.1/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
@@ -86,8 +90,8 @@ github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -99,8 +103,8 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-containerregistry v0.21.6 h1:T+yqQIlJXKrM98Om4DlW3GoWQAmhZuLMwoDOvVrtiUM=
-github.com/google/go-containerregistry v0.21.6/go.mod h1:U7MMSBIJynke2MVQrQk19NP9k/uQsGz/h0amIFSHMbo=
+github.com/google/go-containerregistry v0.21.7 h1:/vPFuVXDjtFREsVArW+0h1CIl5urnOhzei4X2DMW9IU=
+github.com/google/go-containerregistry v0.21.7/go.mod h1:kjSbt7/zMsKLWfnHrIvKvhXHUw91jbe9DNjPPJ32gXE=
 github.com/google/go-intervals v0.0.2 h1:FGrVEiUnTRKR8yE04qzXYaJMtnIYqobR5QbblK3ixcM=
 github.com/google/go-intervals v0.0.2/go.mod h1:MkaR3LNRfeKLPmqgJYs4E66z5InYjmCjbbr4TQlcT6Y=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -137,8 +141,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lxc/go-lxc v0.0.0-20260316180011-3af4ce000ed7 h1:MXZvjx5IYff3AacumHgmaJqWXyfROImWfJzmMP1ye4o=
 github.com/lxc/go-lxc v0.0.0-20260316180011-3af4ce000ed7/go.mod h1:3UTWXVcHfgxE7JM4ZUnsy6bDA8L1vuzwJbJRF6dlB90=
-github.com/lxc/incus/v7 v7.2.0 h1:LCJmJnn6drX6Igi0ZYLdoxV+PP2I62g06wA12UqT7jY=
-github.com/lxc/incus/v7 v7.2.0/go.mod h1:m78+++9iytP0GZLClbY5BLTXzptYkAKVcvleYRAcYOs=
+github.com/lxc/incus/v7 v7.4.0 h1:gZPEQvFVOeeSVhsnZVObcrSCLVfnowBP3VM8Fr5QaAQ=
+github.com/lxc/incus/v7 v7.4.0/go.mod h1:drJHddxdr1men9MS1VYrdjDWBeiI92yL//Aq4oAIPCY=
 github.com/martinjungblut/go-cryptsetup v0.0.0-20220520180014-fd0874fd07a6 h1:YDjLk3wsL5ZLhLC4TIwIvT2NkSCAdAV6pzzZaRfj4jk=
 github.com/martinjungblut/go-cryptsetup v0.0.0-20220520180014-fd0874fd07a6/go.mod h1:gZoZ0+POlM1ge/VUxWpMmZVNPzzMJ7l436CgkQ5+qzU=
 github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
@@ -147,37 +151,37 @@ github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy
 github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
-github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
-github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU=
-github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
-github.com/mattn/go-sqlite3 v1.14.47 h1:jOBI62gS7nKeZv+as1oGEy0+1qISgXwH/QBlR6KbfIo=
-github.com/mattn/go-sqlite3 v1.14.47/go.mod h1:6JTjA44L93a0QCyJef5YvlPoKXntQPjzWv5gtm9sB6w=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/mattn/go-runewidth v0.0.28 h1:rPyg2ybwEKPebvpzVWe1gKBkH8EQFkxO4Y0hjBeLaBU=
+github.com/mattn/go-runewidth v0.0.28/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
+github.com/mattn/go-sqlite3 v1.14.50 h1:dmdFvo1XG4MPzA4IkAmE9upVz/Nj31uRoM5+jC8hYbY=
+github.com/mattn/go-sqlite3 v1.14.50/go.mod h1:6JTjA44L93a0QCyJef5YvlPoKXntQPjzWv5gtm9sB6w=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
-github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
-github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
+github.com/miekg/pkcs11 v1.1.2 h1:/VxmeAX5qU6Q3EwafypogwWbYryHFmF2RpkJmw3m4MQ=
+github.com/miekg/pkcs11 v1.1.2/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
 github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
 github.com/mistifyio/go-zfs/v4 v4.0.0 h1:sU0+5dX45tdDK5xNZ3HBi95nxUc48FS92qbIZEvpAg4=
 github.com/mistifyio/go-zfs/v4 v4.0.0/go.mod h1:weotFtXTHvBwhr9Mv96KYnDkTPBOHFUbm9cBmQpesL0=
 github.com/mitchellh/hashstructure v1.1.0 h1:P6P1hdjqAAknpY/M1CGipelZgp+4y9ja9kmUZPXP+H0=
 github.com/mitchellh/hashstructure v1.1.0/go.mod h1:xUDAozZz0Wmdiufv0uyhnHkUTN6/6d8ulp4AwfLKrmA=
-github.com/moby/buildkit v0.31.1 h1:j3p55abBl4kiXXPZgYX+6zWgB2aefqHXoPown12fIzU=
-github.com/moby/buildkit v0.31.1/go.mod h1:YM5iNEbNCc6L1Zt3YWFB/aXNLufvf4Rcu0DPlc9HwQg=
+github.com/moby/buildkit v0.32.2 h1:Sfy7+u6dUv/2yuBc9KCoK70Re8atuV8aPZ5UOC068Vc=
+github.com/moby/buildkit v0.32.2/go.mod h1:0GB/EJ1d+4VIVqIAgy3asaoGkVXy7IrDfVy7mPhOvg8=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg=
-github.com/moby/moby/api v1.54.2/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
-github.com/moby/moby/client v0.4.1 h1:DMQgisVoMkmMs7fp3ROSdiBnoAu8+vo3GggFl06M/wY=
-github.com/moby/moby/client v0.4.1/go.mod h1:z52C9O2POPOsnxZAy//WtKcQ32P+jT/NGeXu/7nfjGQ=
+github.com/moby/moby/api v1.55.0 h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc=
+github.com/moby/moby/api v1.55.0/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
+github.com/moby/moby/client v0.5.1 h1:tYNaJno4c0HXz12y5BiqEDy0rVTYkWzI26lGvnTMiJw=
+github.com/moby/moby/client v0.5.1/go.mod h1:odLstlZ6uSnfvAgVxMpvgmb8SUdd+siH2T0GBuxVAlM=
 github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
 github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
 github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0=
 github.com/moby/sys/user v0.4.1/go.mod h1:E9QsW5WRe1kUAf7kW8hXKwu1uhsZEAdPLYHYSDudF4Y=
-github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
-github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
+github.com/moby/sys/userns v0.2.0 h1:nEtDtp7NCV/6dutSklNe8FrENPwFdc4mXnZqC/JWgXM=
+github.com/moby/sys/userns v0.2.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -206,8 +210,6 @@ github.com/pkg/xattr v0.4.12/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6k
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/proglottis/gpgme v0.1.6 h1:8WpQ8VWggLdxkuTnW+sZ1r1t92XBNd8GZNDhQ4Rz+98=
 github.com/proglottis/gpgme v0.1.6/go.mod h1:5LoXMgpE4bttgwwdv9bLs/vwqv3qV7F4glEEZ7mRKrM=
 github.com/rogpeppe/fastuuid v1.1.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
@@ -228,10 +230,10 @@ github.com/sigstore/protobuf-specs v0.5.1 h1:/5OPaNuolRJmQfeZLayJGFXMpsRJEdgC6ah
 github.com/sigstore/protobuf-specs v0.5.1/go.mod h1:DRBzpFuE+LnvQMN10/dU6nBeKwVLGEQ6o2FovN2Rats=
 github.com/sigstore/sigstore v1.10.4 h1:ytOmxMgLdcUed3w1SbbZOgcxqwMG61lh1TmZLN+WeZE=
 github.com/sigstore/sigstore v1.10.4/go.mod h1:tDiyrdOref3q6qJxm2G+JHghqfmvifB7hw+EReAfnbI=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
-github.com/smallstep/pkcs7 v0.1.1 h1:x+rPdt2W088V9Vkjho4KtoggyktZJlMduZAtRHm68LU=
-github.com/smallstep/pkcs7 v0.1.1/go.mod h1:dL6j5AIz9GHjVEBTXtW+QliALcgM19RtXaTeyxI+AfA=
+github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
+github.com/sirupsen/logrus v1.10.2/go.mod h1:SLEg8TqYulVKKfIGHldVp2K2aYz2DKSVBq4g/H5bR7Q=
+github.com/smallstep/pkcs7 v0.2.1 h1:6Kfzr/QizdIuB6LSv8y1LJdZ3aPSfTNhTLqAx9CTLfA=
+github.com/smallstep/pkcs7 v0.2.1/go.mod h1:RcXHsMfL+BzH8tRhmrF1NkkpebKpq3JEM66cOFxanf0=
 github.com/smarty/assertions v1.15.0 h1:cR//PqUBUiQRakZWqBiFFQ9wb8emQGDb0HeGdqGByCY=
 github.com/smarty/assertions v1.15.0/go.mod h1:yABtdzeQs6l1brC900WlRNwj6ZR55d7B+E8C6HtKdec=
 github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
@@ -251,8 +253,8 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/tchap/go-patricia/v2 v2.3.3 h1:xfNEsODumaEcCcY3gI0hYPZ/PcpVv5ju6RMAhgwZDDc=
 github.com/tchap/go-patricia/v2 v2.3.3/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
 github.com/tj/assert v0.0.0-20171129193455-018094318fb0/go.mod h1:mZ9/Rh9oLWpLLDRpvE+3b7gP/C2YyLFYxNmcLnPTMe0=
@@ -276,8 +278,10 @@ github.com/vbatts/go-mtree v0.5.4 h1:OMAb8jaCyiFA7zXj0Zc/oARcxBDBoeu2LizjB8BVJl0
 github.com/vbatts/go-mtree v0.5.4/go.mod h1:5GqJbVhm9BBiCc4K5uc/c42FPgXulHaQs4sFUEfIWMo=
 github.com/vbatts/tar-split v0.12.3 h1:Cd46rkGXI3Td4yrVNwU8ripbxFaQbmesqhjBUUYAJSw=
 github.com/vbatts/tar-split v0.12.3/go.mod h1:sQOc6OlqGCr7HkGx/IDBeKiTIvqhmj8KffNhEXG4Nq0=
-github.com/vbauerster/mpb/v8 v8.12.0 h1:+gneY3ifzc88tKDzOtfG8k8gfngCx615S2ZmFM4liWg=
-github.com/vbauerster/mpb/v8 v8.12.0/go.mod h1:V02YIuMVo301Y1VE9VtZlD8s84OMsk+EKN6mwvf/588=
+github.com/vbauerster/cupwriter v0.0.4 h1:9sBPe0uXWLZuWQU5lqVbhyFlxX6c09asST/YfatFAys=
+github.com/vbauerster/cupwriter v0.0.4/go.mod h1:IFyzS6Xis5dnBH/rdAhrnuzg3c+KkUqEN6yE8lhJlDw=
+github.com/vbauerster/mpb/v8 v8.14.0 h1:55SR80dptMfASxIG/oCEkBXgBhxeSu4GrVsjl16oKmA=
+github.com/vbauerster/mpb/v8 v8.14.0/go.mod h1:HgpQPKfcWe3kbuGGPmi+jatHreMase5C3Fp5dpdAy0Q=
 github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 h1:FnBeRrxr7OU4VvAzt5X7s6266i6cSVkkFPS0TuXWbIg=
 github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
@@ -285,24 +289,26 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=
-go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
-go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
-go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
-go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel v1.46.0 h1:FHt5/CDyVxi/8IM1CH7VE/rRgq3kLHa2mSTVMO8AWyc=
+go.opentelemetry.io/otel v1.46.0/go.mod h1:Gj3SEScelsNC45tp4nSxRYlS+f5iez7W8XPMCt905kE=
+go.opentelemetry.io/otel/metric v1.46.0 h1:yBnkXvgV7AXFILZc5K6IZe/CBFF3OS7BJ8ov6/lj0K8=
+go.opentelemetry.io/otel/metric v1.46.0/go.mod h1:iPmdWqifKUdzziPkvvzIJXITl56fQx2mGM/DHLB3/2o=
 go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
 go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
 go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
 go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
-go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
-go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
-go.podman.io/image/v5 v5.40.0 h1:gNQvj343Eb4juCitUBkuDz1T82Zpp6nhgMEXzNfCges=
-go.podman.io/image/v5 v5.40.0/go.mod h1:qgXf1abXJ+2l01pL8+CljaMKryeo6ahaHO7H51ooKIc=
-go.podman.io/storage v1.63.0 h1:bj/pAWFhChbuBmejzno0iQLhU7FevGVXepRXm5pFGeA=
-go.podman.io/storage v1.63.0/go.mod h1:z4Z9K+7GhKjWL/Y1O17+4f8a1KGijVeC9hr3tymhSOs=
+go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu60qs1c=
+go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI=
+go.podman.io/image/v5 v5.41.1 h1:iPrhIt7/aNfRBMuzoxbMUVpQmR7Q75ahnrzkIC4JWLQ=
+go.podman.io/image/v5 v5.41.1/go.mod h1:wfgAlfczPK4ZZw/wn/Av2iJfb3z9Vv+RKWgjHNShzZk=
+go.podman.io/storage v1.64.0 h1:ryHCZO+Zl0ZG7OTHF+Qc4C0zLNuoe9W35zgE7mh2pYw=
+go.podman.io/storage v1.64.0/go.mod h1:ft0DzCRMZs1yn0rszmLYXEEwgd7IIc66JRwSRPUDwwc=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
+go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
 golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -334,8 +340,9 @@ golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
 golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20220408201424-a24fb2fb8a0f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -398,14 +405,14 @@ gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8=
 google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d h1:mpAgMyM9vQHxycBlDq50y1VHpfSfVwzXvrQKtYbXuUY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
-google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 h1:1VUiZAXyC+zmiFYi+WLtBzr68Cj8wOofHjjrA/kkizc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -418,7 +425,6 @@ gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
diff --git a/pkg/container/container.go b/pkg/container/container.go
index 25b924e2..347d8653 100644
--- a/pkg/container/container.go
+++ b/pkg/container/container.go
@@ -147,7 +147,7 @@ func (c *Container) Execute(args []string, stdin io.Reader) error {
 
 	cmd, cleanup, err := embed_exec.GetCommand(
 		c.sc.EmbeddedFS,
-		"lxc-wrapper/lxc-wrapper",
+		c.sc.EmbeddedWrapperPath,
 		append([]string{"spawn", c.c.Name(), c.sc.RootFSDir, f.Name()}, args...)...,
 	)
 	if err != nil {
diff --git a/pkg/container/userns.go b/pkg/container/userns.go
index 47a0eb18..94e1ad66 100644
--- a/pkg/container/userns.go
+++ b/pkg/container/userns.go
@@ -91,7 +91,7 @@ func MaybeRunInNamespace(config types.StackerConfig, userCmd []string) error {
 	log.Debugf("%s-ing %v", args[0], args[1:])
 	cmd, cleanup, err := embed_exec.GetCommand(
 		config.EmbeddedFS,
-		"lxc-wrapper/lxc-wrapper",
+		config.EmbeddedWrapperPath,
 		args...,
 	)
 	if err != nil {
diff --git a/pkg/types/config.go b/pkg/types/config.go
index 3e1f9835..7ca9ccb3 100644
--- a/pkg/types/config.go
+++ b/pkg/types/config.go
@@ -22,10 +22,10 @@ type StackerConfig struct {
 	// SOURCE_DATE_EPOCH environment variable.
 	SourceDateEpoch *time.Time `yaml:"-"`
 
-	// EmbeddedFS should contain a (statically linked) lxc-wrapper binary
-	// (built from cmd/lxc-wrapper/lxc-wrapper.c) at
-	// lxc-wrapper/lxc-wrapper.
-	EmbeddedFS embed.FS `yaml:"-"`
+	// EmbeddedFS should contain a statically linked lxc-wrapper binary built
+	// from cmd/lxc-wrapper/lxc-wrapper.c at EmbeddedWrapperPath.
+	EmbeddedFS          embed.FS `yaml:"-"`
+	EmbeddedWrapperPath string   `yaml:"-"`
 }
 
 // Substitutions - return an array of substitutions for StackerFiles
diff --git a/test/atomfs-erofs.bats b/test/atomfs-erofs.bats
index 2662faf6..f5b6c689 100644
--- a/test/atomfs-erofs.bats
+++ b/test/atomfs-erofs.bats
@@ -137,6 +137,8 @@ EOF
 
 @test "bad existing verity device is rejected" {
     require_privilege priv
+    # This test creates a host-global device-mapper name from the layer hash.
+    # Keep its layer distinct from the concurrently running mount test.
     cat > stacker.yaml <<"EOF"
 test:
     from:
@@ -144,12 +146,15 @@ test:
         url: ${{BUSYBOX_OCI}}
     run: |
         touch /hello
+        touch /bad-existing-verity-device-erofs
 EOF
     stacker build --layer-type=erofs --substitute BUSYBOX_OCI=${BUSYBOX_OCI}
 
     manifest=$(cat oci/index.json | jq -r .manifests[0].digest | cut -f2 -d:)
-    first_layer_hash=$(cat oci/blobs/sha256/$manifest | jq -r .layers[0].digest | cut -f2 -d:)
-    devname="$first_layer_hash-verity"
+    # Use this test's unique top layer, not the common base image layer.
+    last_layer_num=$(($(cat oci/blobs/sha256/$manifest | jq -r '.layers | length')-1))
+    last_layer_hash=$(cat oci/blobs/sha256/$manifest | jq -r .layers[$last_layer_num].digest | cut -f2 -d:)
+    devname="$last_layer_hash-verity"
 
     # make an evil device and fake it as an existing verity device
     dd if=/dev/random of=mydev bs=50K count=1
diff --git a/test/atomfs-squashfs.bats b/test/atomfs-squashfs.bats
index dd5118d8..01e75147 100644
--- a/test/atomfs-squashfs.bats
+++ b/test/atomfs-squashfs.bats
@@ -137,6 +137,8 @@ EOF
 
 @test "bad existing verity device is rejected" {
     require_privilege priv
+    # This test creates a host-global device-mapper name from the layer hash.
+    # Keep its layer distinct from the concurrently running mount test.
     cat > stacker.yaml <<"EOF"
 test:
     from:
@@ -144,12 +146,15 @@ test:
         url: ${{BUSYBOX_OCI}}
     run: |
         touch /hello
+        touch /bad-existing-verity-device-squashfs
 EOF
     stacker build --layer-type=squashfs --substitute BUSYBOX_OCI=${BUSYBOX_OCI}
 
     manifest=$(cat oci/index.json | jq -r .manifests[0].digest | cut -f2 -d:)
-    first_layer_hash=$(cat oci/blobs/sha256/$manifest | jq -r .layers[0].digest | cut -f2 -d:)
-    devname="$first_layer_hash-verity"
+    # Use this test's unique top layer, not the common base image layer.
+    last_layer_num=$(($(cat oci/blobs/sha256/$manifest | jq -r '.layers | length')-1))
+    last_layer_hash=$(cat oci/blobs/sha256/$manifest | jq -r .layers[$last_layer_num].digest | cut -f2 -d:)
+    devname="$last_layer_hash-verity"
 
     # make an evil device and fake it as an existing verity device
     dd if=/dev/random of=mydev bs=50K count=1
diff --git a/test/basic.bats b/test/basic.bats
index 7853d80a..d68d8659 100644
--- a/test/basic.bats
+++ b/test/basic.bats
@@ -92,11 +92,6 @@ EOF
     config=$(cat oci/blobs/sha256/$manifest | jq -r .config.digest | cut -f2 -d:)
     [ "$(cat oci/blobs/sha256/$config | jq -r '.config.Entrypoint | join(" ")')" = "echo hello world" ]
 
-    publishedGitVersion=$(cat oci/blobs/sha256/$manifest | jq -r '.annotations."io.stackeroci.stacker.git_version"')
-    echo "WARK1: publishedGitVersion=${publishedGitVersion}" >&3
-    echo "WARK1: VERSION_FULL=${VERSION_FULL}" >&3
-    [ "$publishedGitVersion" = "$VERSION_FULL" ]
-
     # need to trim the extra newline from jq
     cat oci/blobs/sha256/$manifest | jq -r '.annotations."io.stackeroci.stacker.stacker_yaml"' | sed '$ d' > stacker_yaml_annotation
 
@@ -136,6 +131,34 @@ EOF
     [ ! -d dest/rootfs/stacker ]
 }
 
+@test "git version annotation matches stackerfile repository" {
+    local gitdir="$TEST_TMPDIR/stackerfile-git"
+    local gitTag="v0.0.1"
+
+    mkdir "$gitdir"
+    cat > "$gitdir/stacker.yaml" <<"EOF"
+busybox:
+    from:
+        type: oci
+        url: ${{BUSYBOX_OCI}}
+    run: |
+        touch /foo
+EOF
+    git -C "$gitdir" init -q
+    git -C "$gitdir" add stacker.yaml
+    git -C "$gitdir" -c user.name=stacker-test -c user.email=stacker@test commit -qm test
+    git -C "$gitdir" tag "$gitTag"
+    give_user_ownership "$gitdir"
+
+    stacker build -f "$gitdir/stacker.yaml" --substitute BUSYBOX_OCI=${BUSYBOX_OCI}
+
+    manifest=$(cat oci/index.json | jq -r .manifests[0].digest | cut -f2 -d:)
+    publishedGitVersion=$(cat oci/blobs/sha256/$manifest | jq -r '.annotations."io.stackeroci.stacker.git_version"')
+    echo "publishedGitVersion=${publishedGitVersion}" >&3
+    echo "repositoryGitTag   =${gitTag}" >&3
+    [ "$publishedGitVersion" = "$gitTag" ]
+}
+
 @test "stacker.yaml without imports can run" {
     cat > stacker.yaml <<"EOF"
 busybox:
@@ -257,11 +280,6 @@ EOF
     config=$(cat oci/blobs/sha256/$manifest | jq -r .config.digest | cut -f2 -d:)
     [ "$(cat oci/blobs/sha256/$config | jq -r '.config.Entrypoint | join(" ")')" = "echo hello world" ]
 
-    publishedGitVersion=$(cat oci/blobs/sha256/$manifest | jq -r '.annotations."io.stackeroci.stacker.git_version"')
-    echo "WARK2: publishedGitVersion=${publishedGitVersion}" >&3
-    echo "WARK2: VERSION_FULL=${VERSION_FULL}" >&3
-    [ "$publishedGitVersion" = "$VERSION_FULL" ]
-
     # need to trim the extra newline from jq
     cat oci/blobs/sha256/$manifest | jq -r '.annotations."io.stackeroci.stacker.stacker_yaml"' | sed '$ d' > stacker_yaml_annotation
 
diff --git a/test/concurrent.bats b/test/concurrent.bats
index 5e90aeba..482ef140 100644
--- a/test/concurrent.bats
+++ b/test/concurrent.bats
@@ -37,5 +37,7 @@ EOF
 EOF
 
     kill -9 $snoozpid
+    # Reap the intentionally killed build without printing Bash's "Killed" notice.
+    wait "$snoozpid" 2>/dev/null || true
 
 }
diff --git a/test/convert.bats b/test/convert.bats
index a4728013..8926a7f1 100644
--- a/test/convert.bats
+++ b/test/convert.bats
@@ -46,6 +46,7 @@ EOF
   # build should now work
   ## docker build -t test
   mkdir -p /out
+  echo "# building converted Dockerfile; this may take several minutes" >&3
   stacker build -f stacker.yaml --substitute-file stacker-subs.yaml --substitute IMAGE=app
   if [ -z "${REGISTRY_URL}" ]; then
     skip "publish step of test because no registry found in REGISTRY_URL env variable"
@@ -55,12 +56,14 @@ EOF
   stacker clean
 }
 
-@test "alpine" {
+@test "alpine convert and build" {
   skip_slow_test
-  git clone https://github.com/alpinelinux/docker-alpine.git
+  echo "# cloning alpine Dockerfile repository; this may take some time" >&3
+  git clone --depth 1 https://github.com/alpinelinux/docker-alpine.git
   chmod -R a+rwx docker-alpine
   cd docker-alpine
   TEMPDIR=$(mktemp -d)
+  echo "# converting and building alpine; this may take several minutes" >&3
   stacker convert --docker-file Dockerfile --output-file stacker.yaml --substitute-file stacker-subs.yaml
   stacker build -f stacker.yaml --substitute-file stacker-subs.yaml --substitute IMAGE=alpine --substitute STACKER_VOL1="$TEMPDIR"
   if [ -nz "${REGISTRY_URL}" ]; then
@@ -70,11 +73,13 @@ EOF
   stacker clean
 }
 
-@test "elasticsearch" {
+@test "elasticsearch convert and build" {
   skip_slow_test
+  echo "# cloning elasticsearch Dockerfile repository; this may take some time" >&3
   git clone --branch v8.17.10 --depth 1 https://github.com/elastic/dockerfiles.git
   chmod -R a+rwx dockerfiles
   cd dockerfiles/elasticsearch
+  echo "# converting and building elasticsearch; this may take several minutes" >&3
   stacker convert --docker-file Dockerfile --output-file stacker.yaml --substitute-file stacker-subs.yaml
   stacker build -f stacker.yaml --substitute-file stacker-subs.yaml --substitute IMAGE=elasticsearch
   if [ -nz "${REGISTRY_URL}" ]; then
@@ -83,14 +88,18 @@ EOF
   rm -f stacker.yaml stacker-subs.yaml
   stacker clean
 }
-@test "python" {
+@test "python3 convert and build" {
   skip_slow_test
-  git clone https://github.com/docker-library/python.git
+  echo "# cloning python Dockerfile repository; this may take some time" >&3
+  git init -q python
   cd python
-  # pick a specific commit so we don't get broken by upstream changes:
-  git reset --hard aad39d215779f27b410b25f612b6680a75781edb
+  git remote add origin https://github.com/docker-library/python.git
+  # Fetch only the pinned commit so we do not need the repository's full history.
+  git fetch --depth 1 origin aad39d215779f27b410b25f612b6680a75781edb
+  git checkout --detach FETCH_HEAD
   cd 3.11/alpine3.22
   chmod -R a+rw .
+  echo "# converting and building python; this may take several minutes" >&3
   stacker convert --docker-file Dockerfile --output-file stacker.yaml --substitute-file stacker-subs.yaml
   stacker build -f stacker.yaml --substitute-file stacker-subs.yaml --substitute IMAGE=python
   if [ -nz "${REGISTRY_URL}" ]; then
diff --git a/test/import-http.bats b/test/import-http.bats
index 236a7c1c..52be39f0 100644
--- a/test/import-http.bats
+++ b/test/import-http.bats
@@ -2,6 +2,7 @@ load helpers
 
 function setup() {
     stacker_setup
+    NETNS_NAME="stacker-test-${BATS_TEST_NUMBER}"
     mkdir -p reference
     mkdir -p dest
     rm -f nm_orig
@@ -35,7 +36,7 @@ function teardown() {
     rm -rf img || true
     rm -rf reference || true
     rm -rf dest || true
-    ip netns del stacker-test || true
+    ip netns del "$NETNS_NAME" 2>/dev/null || true
 }
 
 @test "importing from cache works for unreachable http urls" {
@@ -48,8 +49,9 @@ function teardown() {
     stacker build -f img/stacker2.yaml
     umoci ls --layout oci
     # Second execution reads from the cache, but cannot access the net
-    ip netns add stacker-test
-    run ip netns exec stacker-test "${ROOT_DIR}/stacker" build -f img/stacker2.yaml
+    ip netns del "$NETNS_NAME" 2>/dev/null || true
+    ip netns add "$NETNS_NAME"
+    run ip netns exec "$NETNS_NAME" "${ROOT_DIR}/stacker" build -f img/stacker2.yaml
     echo $output
     [ "$status" -eq 0 ]
     umoci ls --layout oci
diff --git a/test/import.bats b/test/import.bats
index 8beee20b..ec17f832 100644
--- a/test/import.bats
+++ b/test/import.bats
@@ -205,7 +205,7 @@ EOF
     echo $output | grep 'hash does not match'
 }
 
-@test "`require hash` flag allows build when hash is provided" {
+@test "--require-hash allows build when hash is provided" {
     touch test_file
     test_file_sha=$(sha test_file) || { stderr "failed sha $test_file"; return 1; }
     wget https://google.com/favicon.ico -O google_fav
@@ -229,7 +229,7 @@ EOF
     stacker build --require-hash
 }
 
-@test "`require hash` flag fails build when http import hash is not provided" {
+@test "--require-hash fails build when http import hash is not provided" {
     touch test_file
     test_file_sha=$(sha test_file) || { stderr "failed sha $test_file"; return 1; }
     wget https://google.com/favicon.ico -O google_fav
@@ -249,7 +249,7 @@ EOF
     bad_stacker build --require-hash
 }
 
-@test "`require hash` flag allows build even when local hash is not provided" {
+@test "--require-hash allows build even when local hash is not provided" {
     touch test_file
     wget https://google.com/favicon.ico -O google_fav
     google_sha=$(sha google_fav) || { stderr "failed sha $google_fav"; return 1; }
diff --git a/test/main.py b/test/main.py
index 144f70db..8de27c88 100755
--- a/test/main.py
+++ b/test/main.py
@@ -7,8 +7,12 @@
 import glob
 import multiprocessing
 import os
+from pathlib import Path
+import re
+import shutil
 import subprocess
 import sys
+import tempfile
 
 
 def check_env(env_to_check):
@@ -27,6 +31,71 @@ def check_env(env_to_check):
         raise RuntimeError(f"EnvCheckFailures: {errors}")
 
 
+def dump_log(log):
+    print(f"\n--- Bats log: {log} ---")
+    try:
+        print(log.read_text(errors="replace"), end="")
+    except OSError as err:
+        print(f"Unable to read {log}: {err}")
+
+
+def dump_bats_logs(tmpdir):
+    run_dirs = sorted(Path(tmpdir).glob("bats-run-*"))
+    failed_logs = []
+    for run_dir in run_dirs:
+        for stdout in (run_dir / "parallel_output").glob("*/stdout"):
+            try:
+                if "not ok " in stdout.read_text(errors="replace"):
+                    failed_logs.append(stdout)
+            except OSError:
+                continue
+
+    print(f"Bats failure logs retained in {tmpdir}")
+    if failed_logs:
+        for stdout in sorted(failed_logs, key=lambda log: int(log.parent.name)):
+            test_name = stdout.parents[2] / "test" / f"{stdout.parent.name}.name"
+            if test_name.is_file():
+                print(f"\nBats failed test: {test_name.read_text().strip()}")
+            dump_log(stdout)
+            stderr = stdout.with_name("stderr")
+            if stderr.is_file() and stderr.stat().st_size:
+                dump_log(stderr)
+        return
+
+    print("No failed test worker log was found; dumping suite-level diagnostics.")
+    for run_dir in run_dirs:
+        for log in (run_dir / "warnings.log", run_dir / "suite.out"):
+            if log.is_file() and log.stat().st_size:
+                dump_log(log)
+
+
+def run_bats(cmd, env):
+    abort_count_warning = re.compile(
+        r"# bats warning: Executed (\d+) instead of expected (\d+) tests"
+    )
+    run_tmpdir_notice = re.compile(r"BATS_RUN_TMPDIR: .+")
+    bats = subprocess.Popen(
+        cmd,
+        env=env,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        text=True,
+    )
+    for line in bats.stdout:
+        match = abort_count_warning.fullmatch(line.rstrip("\n"))
+        if match:
+            print(
+                "# Bats fail-fast: reported results for "
+                f"{match.group(1)} of {match.group(2)} planned tests before stopping.",
+                flush=True,
+            )
+        elif run_tmpdir_notice.fullmatch(line.rstrip("\n")):
+            continue
+        else:
+            print(line, end="", flush=True)
+    return bats.wait()
+
+
 priv_levels = ("priv", "unpriv")
 
 parser = argparse.ArgumentParser()
@@ -48,6 +117,10 @@ def check_env(env_to_check):
         "./test/setup_suite.bash",
         "--jobs",
         str(options.jobs),
+        # Keep test cases parallel, but let Bats report a failing file directly.
+        "--no-parallelize-across-files",
+        "--no-tempdir-cleanup",
+        "--abort",
         "--tap",
         "--timing",
         "--verbose-run",
@@ -55,6 +128,10 @@ def check_env(env_to_check):
     cmd.extend(options.tests)
 
     env = os.environ.copy()
+    bats_tmpdir = tempfile.mkdtemp(prefix="stacker-bats-")
+    # Mode 0711 lets unprivileged tests traverse TMPDIR without listing retained logs.
+    os.chmod(bats_tmpdir, 0o711)
+    env["TMPDIR"] = bats_tmpdir
     env["PRIVILEGE_LEVEL"] = priv
     try:
         check_env
@@ -64,7 +141,11 @@ def check_env(env_to_check):
 
     print("running tests in modes:", priv)
     try:
-        subprocess.check_call(cmd, env=env)
+        if run_bats(cmd, env) != 0:
+            raise subprocess.CalledProcessError(1, cmd)
     except subprocess.CalledProcessError:
         print("tests in modes:", priv, "failed")
+        dump_bats_logs(bats_tmpdir)
         sys.exit(1)
+    else:
+        shutil.rmtree(bats_tmpdir)