diff --git a/Makefile.toml b/Makefile.toml
index 8a3bee8ca6e..71ab99ce458 100644
--- a/Makefile.toml
+++ b/Makefile.toml
@@ -441,7 +441,7 @@ rc=0
 if ! docker run --rm \
   --network=none \
   --user "$(id -u):$(id -g)" \
-  --security-opt label:disable \
+  --security-opt="label=disable" \
   -v "${BUILDSYS_TOOLS_DIR}":/tmp/tools \
   "${BUILDSYS_SDK_IMAGE}" \
   bash -c \
@@ -592,7 +592,7 @@ fi
 docker run --rm \
    --network=none \
    --user "$(id -u):$(id -g)" \
-   --security-opt label:disable \
+   --security-opt="label=disable" \
    -v "${BOOT_CONFIG_INPUT}":/tmp/bootconfig-input \
    -v "${boot_config}":/tmp/bootconfig.data \
    "${BUILDSYS_SDK_IMAGE}" \
@@ -613,7 +613,7 @@ script = [
 docker run --rm \
    --network=none \
    --user "$(id -u):$(id -g)" \
-   --security-opt label:disable \
+   --security-opt="label=disable" \
    -v "${BOOT_CONFIG}":/tmp/bootconfig.data \
    "${BUILDSYS_SDK_IMAGE}" \
    bootconfig -l /tmp/bootconfig.data
@@ -692,7 +692,7 @@ set +e
 docker run --rm \
   --network=none \
   --user "$(id -u):$(id -g)" \
-  --security-opt label:disable \
+  --security-opt="label=disable" \
   -e CARGO_HOME="/tmp/.cargo" \
   -v "${CARGO_HOME}":/tmp/.cargo \
   -v "${BUILDSYS_ROOT_DIR}/sources":/tmp/sources \
@@ -730,7 +730,7 @@ set +e
 
 docker run --rm \
   --user "$(id -u):$(id -g)" \
-  --security-opt label:disable \
+  --security-opt="label=disable" \
   -e CARGO_HOME="/tmp/.cargo" \
   -v "${CARGO_HOME}":/tmp/.cargo \
   -v "${BUILDSYS_ROOT_DIR}/licenses:/tmp/licenses" \
diff --git a/PROVISIONING-METAL.md b/PROVISIONING-METAL.md
index 264efcd31bf..f45d8721706 100644
--- a/PROVISIONING-METAL.md
+++ b/PROVISIONING-METAL.md
@@ -307,7 +307,7 @@ touch $(pwd)/bootconfig.data
 docker run --rm \
    --network=none \
    --user "$(id -u):$(id -g)" \
-   --security-opt label:disable \
+   --security-opt label=disable \
    -v $(pwd)/bootconfig-input:/tmp/bootconfig-input \
    -v $(pwd)/bootconfig.data:/tmp/bootconfig.data \
    "${SDK_IMAGE}" \
@@ -327,7 +327,7 @@ SDK_IMAGE="public.ecr.aws/bottlerocket/bottlerocket-sdk-${ARCH}:${SDK_VERSION}"
 docker run --rm \
    --network=none \
    --user "$(id -u):$(id -g)" \
-   --security-opt label:disable \
+   --security-opt label=disable \
    -v $(pwd)/bootconfig.data:/tmp/bootconfig.data \
    "${SDK_IMAGE}" \
    bootconfig -l /tmp/bootconfig.data
diff --git a/tools/docker-go b/tools/docker-go
index d0b625c4caf..82a88c6d514 100755
--- a/tools/docker-go
+++ b/tools/docker-go
@@ -82,7 +82,7 @@ docker run --rm \
   "${go_env[@]}" \
   "${proxy_env[@]}" \
   --user "$(id -u):$(id -g)" \
-  --security-opt label:disable \
+  --security-opt="label=disable" \
   ${DOCKER_RUN_ARGS} \
   -v "${GO_MOD_CACHE}":/tmp/go/pkg/mod \
   -v "${GO_MODULE_PATH}":/usr/src/module \