diff --git a/.konflux/build-args-konflux.conf b/.konflux/build-args-konflux.conf
index b12b1d8cd..a8274d2de 100644
--- a/.konflux/build-args-konflux.conf
+++ b/.konflux/build-args-konflux.conf
@@ -1,4 +1,4 @@
-BUILDER_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.4.2-1782270165
+BUILDER_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.4.2-1782914778
 BUILDER_DNF_COMMAND=dnf
-RUNTIME_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.4.2-1782270165
+RUNTIME_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.4.2-1782914778
 RUNTIME_DNF_COMMAND=dnf
diff --git a/.konflux/rpms.in.yaml b/.konflux/rpms.in.yaml
index ac6928fce..96ef6239a 100644
--- a/.konflux/rpms.in.yaml
+++ b/.konflux/rpms.in.yaml
@@ -9,9 +9,12 @@ packages:
   ]
 upgradePackages:
   [
-    gnutls,
-    libxslt,
-    openssl-fips-provider,
+    libssh,
+    libtiff,
+    openexr-libs,
+    p11-kit,
+    p11-kit-trust,
+    shadow-utils,
   ]
 contentOrigin:
   repofiles: ["./redhat.repo"]
diff --git a/.konflux/rpms.lock.yaml b/.konflux/rpms.lock.yaml
index ab30dba42..6bf117667 100644
--- a/.konflux/rpms.lock.yaml
+++ b/.konflux/rpms.lock.yaml
@@ -39,13 +39,13 @@ arches:
     name: libuv
     evr: 1:1.42.0-2.el9_4
     sourcerpm: libuv-1.42.0-2.el9_4.src.rpm
-  - url: https://cdn.redhat.com/content/eus/rhel9/9.6/aarch64/appstream/os/Packages/l/libxslt-1.1.34-13.el9_6.2.aarch64.rpm
+  - url: https://cdn.redhat.com/content/eus/rhel9/9.6/aarch64/appstream/os/Packages/o/openexr-libs-3.1.1-3.el9_6.3.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-eus-rpms__9_DOT_6
-    size: 244531
-    checksum: sha256:b87f5b4991bb04771ce1c6c26611a9eeb754fa80ffc257199e68db6ed5f03959
-    name: libxslt
-    evr: 1.1.34-13.el9_6.2
-    sourcerpm: libxslt-1.1.34-13.el9_6.2.src.rpm
+    size: 1056117
+    checksum: sha256:dfa828bd3c0889d9c37a63aef245adbd3a7c5b5c590e5f15d0f2e232de50a287
+    name: openexr-libs
+    evr: 3.1.1-3.el9_6.3
+    sourcerpm: openexr-3.1.1-3.el9_6.3.src.rpm
   - url: https://cdn.redhat.com/content/eus/rhel9/9.6/aarch64/appstream/os/Packages/p/patch-2.7.6-16.el9.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-eus-rpms__9_DOT_6
     size: 129037
@@ -74,13 +74,6 @@ arches:
     name: ed
     evr: 1.14.2-12.el9
     sourcerpm: ed-1.14.2-12.el9.src.rpm
-  - url: https://cdn.redhat.com/content/eus/rhel9/9.6/aarch64/baseos/os/Packages/g/gnutls-3.8.3-6.el9_6.4.aarch64.rpm
-    repoid: rhel-9-for-aarch64-baseos-eus-rpms__9_DOT_6
-    size: 1051990
-    checksum: sha256:e766b1d568983ae2dff7ae7ccec729f5edd49795ef367a806ed06810ee4c68de
-    name: gnutls
-    evr: 3.8.3-6.el9_6.4
-    sourcerpm: gnutls-3.8.3-6.el9_6.4.src.rpm
   - url: https://cdn.redhat.com/content/eus/rhel9/9.6/aarch64/baseos/os/Packages/i/info-6.7-15.el9.aarch64.rpm
     repoid: rhel-9-for-aarch64-baseos-eus-rpms__9_DOT_6
     size: 230301
@@ -88,20 +81,6 @@ arches:
     name: info
     evr: 6.7-15.el9
     sourcerpm: texinfo-6.7-15.el9.src.rpm
-  - url: https://cdn.redhat.com/content/eus/rhel9/9.6/aarch64/baseos/os/Packages/o/openssl-fips-provider-3.0.7-11.el9_0.aarch64.rpm
-    repoid: rhel-9-for-aarch64-baseos-eus-rpms__9_DOT_6
-    size: 10281
-    checksum: sha256:29f0ed0694669438654fd2f7ed288262aafddd84f09ff9fa017cc71ee4990df1
-    name: openssl-fips-provider
-    evr: 3.0.7-11.el9_0
-    sourcerpm: openssl-fips-provider-3.0.7-11.el9_0.src.rpm
-  - url: https://cdn.redhat.com/content/eus/rhel9/9.6/aarch64/baseos/os/Packages/o/openssl-fips-provider-so-3.0.7-11.el9_0.aarch64.rpm
-    repoid: rhel-9-for-aarch64-baseos-eus-rpms__9_DOT_6
-    size: 522978
-    checksum: sha256:6699bd711fa3e30f576a062029c62529f362a93657066dd87fc8704d730cff42
-    name: openssl-fips-provider-so
-    evr: 3.0.7-11.el9_0
-    sourcerpm: openssl-fips-provider-3.0.7-11.el9_0.src.rpm
   source: []
   module_metadata: []
 - arch: x86_64
@@ -141,13 +120,13 @@ arches:
     name: libuv
     evr: 1:1.42.0-2.el9_4
     sourcerpm: libuv-1.42.0-2.el9_4.src.rpm
-  - url: https://cdn.redhat.com/content/eus/rhel9/9.6/x86_64/appstream/os/Packages/l/libxslt-1.1.34-13.el9_6.2.x86_64.rpm
+  - url: https://cdn.redhat.com/content/eus/rhel9/9.6/x86_64/appstream/os/Packages/o/openexr-libs-3.1.1-3.el9_6.3.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-eus-rpms__9_DOT_6
-    size: 247315
-    checksum: sha256:fbaad5f1ca8422cd20ede7324bf4fc2cc013e5ef106f698f89f50271727b6152
-    name: libxslt
-    evr: 1.1.34-13.el9_6.2
-    sourcerpm: libxslt-1.1.34-13.el9_6.2.src.rpm
+    size: 1124250
+    checksum: sha256:ac379873890f8eb038008041f60dc52f3f5f5c48e83a44c48d51f6b7a25b0f7e
+    name: openexr-libs
+    evr: 3.1.1-3.el9_6.3
+    sourcerpm: openexr-3.1.1-3.el9_6.3.src.rpm
   - url: https://cdn.redhat.com/content/eus/rhel9/9.6/x86_64/appstream/os/Packages/p/patch-2.7.6-16.el9.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-eus-rpms__9_DOT_6
     size: 133240
@@ -176,13 +155,6 @@ arches:
     name: ed
     evr: 1.14.2-12.el9
     sourcerpm: ed-1.14.2-12.el9.src.rpm
-  - url: https://cdn.redhat.com/content/eus/rhel9/9.6/x86_64/baseos/os/Packages/g/gnutls-3.8.3-6.el9_6.4.x86_64.rpm
-    repoid: rhel-9-for-x86_64-baseos-eus-rpms__9_DOT_6
-    size: 1127930
-    checksum: sha256:4e2c0319c285bf9be7db3f2ec0e1437c07f99ce2f7b32f3de4de946670119dfc
-    name: gnutls
-    evr: 3.8.3-6.el9_6.4
-    sourcerpm: gnutls-3.8.3-6.el9_6.4.src.rpm
   - url: https://cdn.redhat.com/content/eus/rhel9/9.6/x86_64/baseos/os/Packages/i/info-6.7-15.el9.x86_64.rpm
     repoid: rhel-9-for-x86_64-baseos-eus-rpms__9_DOT_6
     size: 233806
@@ -190,19 +162,5 @@ arches:
     name: info
     evr: 6.7-15.el9
     sourcerpm: texinfo-6.7-15.el9.src.rpm
-  - url: https://cdn.redhat.com/content/eus/rhel9/9.6/x86_64/baseos/os/Packages/o/openssl-fips-provider-3.0.7-11.el9_0.x86_64.rpm
-    repoid: rhel-9-for-x86_64-baseos-eus-rpms__9_DOT_6
-    size: 10316
-    checksum: sha256:9cd99e98e91da4b15eb773b4be035aaee63a369fda70cbb38371455c3217bed1
-    name: openssl-fips-provider
-    evr: 3.0.7-11.el9_0
-    sourcerpm: openssl-fips-provider-3.0.7-11.el9_0.src.rpm
-  - url: https://cdn.redhat.com/content/eus/rhel9/9.6/x86_64/baseos/os/Packages/o/openssl-fips-provider-so-3.0.7-11.el9_0.x86_64.rpm
-    repoid: rhel-9-for-x86_64-baseos-eus-rpms__9_DOT_6
-    size: 588706
-    checksum: sha256:8b6af65ac0eafbd1eb85d0f73c8255ea979418032fd4aa189a4a65004bcf1ef3
-    name: openssl-fips-provider-so
-    evr: 3.0.7-11.el9_0
-    sourcerpm: openssl-fips-provider-3.0.7-11.el9_0.src.rpm
   source: []
   module_metadata: []
diff --git a/Containerfile b/Containerfile
index 199c16aec..c61404a29 100644
--- a/Containerfile
+++ b/Containerfile
@@ -25,7 +25,7 @@ USER root
 # (dependency of autoevals, no pre-built binary wheels for linux on aarch64)
 # cmake and cargo are required by fastuuid, maturin
 RUN ${BUILDER_DNF_COMMAND} install -y --nodocs --setopt=keepcache=0 --setopt=tsflags=nodocs gcc gcc-c++ cmake cargo && \
-    ${BUILDER_DNF_COMMAND} update -y --nodocs --setopt=keepcache=0 --setopt=tsflags=nodocs gnutls libxslt openssl-fips-provider
+    ${BUILDER_DNF_COMMAND} update -y --nodocs --setopt=keepcache=0 --setopt=tsflags=nodocs
 
 # Install uv package manager
 RUN pip3.12 install "uv>=0.8.15"
@@ -117,7 +117,7 @@ USER root
 
 # Additional tools for derived images
 RUN ${RUNTIME_DNF_COMMAND} install -y --nodocs --setopt=keepcache=0 --setopt=tsflags=nodocs jq patch && \
-    ${RUNTIME_DNF_COMMAND} update -y --nodocs --setopt=keepcache=0 --setopt=tsflags=nodocs gnutls libxslt openssl-fips-provider
+    ${RUNTIME_DNF_COMMAND} update -y --nodocs --setopt=keepcache=0 --setopt=tsflags=nodocs
 
 # Create llama-stack directories for library mode
 RUN mkdir -p /opt/app-root/src/.llama/storage /opt/app-root/src/.llama/providers.d && \