diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 272fe2f6f3ca..490b783cce57 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,5 +1,5 @@
 {
-  "image": "ghcr.io/dfinity/ic-build@sha256:d7480d9e753f83ef8900edca2d45903d3f2215d2fba3367325c8bc6fc8f0de54",
+  "image": "ghcr.io/dfinity/ic-build@sha256:ca256c678300a63897eaf2574c2d0044391fd1137b7a5e9b0f4224f9cd81d00a",
   "remoteUser": "ubuntu",
   "privileged": true,
   "runArgs": [
diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
index 68080c82f002..39999a6023b7 100644
--- a/.github/workflows/ci-main.yml
+++ b/.github/workflows/ci-main.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:d7480d9e753f83ef8900edca2d45903d3f2215d2fba3367325c8bc6fc8f0de54
+      image: ghcr.io/dfinity/ic-build@sha256:ca256c678300a63897eaf2574c2d0044391fd1137b7a5e9b0f4224f9cd81d00a
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     timeout-minutes: 90
diff --git a/.github/workflows/ci-pr-only.yml b/.github/workflows/ci-pr-only.yml
index 235f3a066039..8f2698bcf957 100644
--- a/.github/workflows/ci-pr-only.yml
+++ b/.github/workflows/ci-pr-only.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: &dind-small-setup
       labels: dind-small
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:d7480d9e753f83ef8900edca2d45903d3f2215d2fba3367325c8bc6fc8f0de54
+      image: ghcr.io/dfinity/ic-build@sha256:ca256c678300a63897eaf2574c2d0044391fd1137b7a5e9b0f4224f9cd81d00a
       options: >-
          -e NODE_NAME --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     steps:
diff --git a/.github/workflows/container-base-images.yml b/.github/workflows/container-base-images.yml
index 71564187ab20..874b29a863e5 100644
--- a/.github/workflows/container-base-images.yml
+++ b/.github/workflows/container-base-images.yml
@@ -131,6 +131,7 @@ jobs:
         shell: bash
         run: |
           set -xeuo pipefail
+          sudo apt-get update && sudo apt-get install -y rsync
           find artifacts
           rsync -rv artifacts/ .
           rm -rf artifacts
diff --git a/.github/workflows/pocket-ic-tests-windows.yml b/.github/workflows/pocket-ic-tests-windows.yml
index 479e713d8ada..6dc5bb2a1b89 100644
--- a/.github/workflows/pocket-ic-tests-windows.yml
+++ b/.github/workflows/pocket-ic-tests-windows.yml
@@ -45,7 +45,7 @@ jobs:
   bazel-build-pocket-ic:
     name: Bazel Build PocketIC
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:d7480d9e753f83ef8900edca2d45903d3f2215d2fba3367325c8bc6fc8f0de54
+      image: ghcr.io/dfinity/ic-build@sha256:ca256c678300a63897eaf2574c2d0044391fd1137b7a5e9b0f4224f9cd81d00a
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     timeout-minutes: 90
diff --git a/.github/workflows/rate-limits-backend-release.yml b/.github/workflows/rate-limits-backend-release.yml
index b0ad41215435..7a8f2ef35037 100644
--- a/.github/workflows/rate-limits-backend-release.yml
+++ b/.github/workflows/rate-limits-backend-release.yml
@@ -32,7 +32,7 @@ jobs:
       labels: dind-large
 
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:d7480d9e753f83ef8900edca2d45903d3f2215d2fba3367325c8bc6fc8f0de54
+      image: ghcr.io/dfinity/ic-build@sha256:ca256c678300a63897eaf2574c2d0044391fd1137b7a5e9b0f4224f9cd81d00a
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
 
diff --git a/.github/workflows/release-testing.yml b/.github/workflows/release-testing.yml
index 93a1d18d9b2e..7f140ab0e81b 100644
--- a/.github/workflows/release-testing.yml
+++ b/.github/workflows/release-testing.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:d7480d9e753f83ef8900edca2d45903d3f2215d2fba3367325c8bc6fc8f0de54
+      image: ghcr.io/dfinity/ic-build@sha256:ca256c678300a63897eaf2574c2d0044391fd1137b7a5e9b0f4224f9cd81d00a
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     timeout-minutes: 180
diff --git a/.github/workflows/rosetta-release.yml b/.github/workflows/rosetta-release.yml
index 0bd367a6043f..3602f100d844 100644
--- a/.github/workflows/rosetta-release.yml
+++ b/.github/workflows/rosetta-release.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:d7480d9e753f83ef8900edca2d45903d3f2215d2fba3367325c8bc6fc8f0de54
+      image: ghcr.io/dfinity/ic-build@sha256:ca256c678300a63897eaf2574c2d0044391fd1137b7a5e9b0f4224f9cd81d00a
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     environment: DockerHub
diff --git a/.github/workflows/salt-sharing-canister-release.yml b/.github/workflows/salt-sharing-canister-release.yml
index 8d5becb60235..08272010a1f3 100644
--- a/.github/workflows/salt-sharing-canister-release.yml
+++ b/.github/workflows/salt-sharing-canister-release.yml
@@ -32,7 +32,7 @@ jobs:
       labels: dind-large
 
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:d7480d9e753f83ef8900edca2d45903d3f2215d2fba3367325c8bc6fc8f0de54
+      image: ghcr.io/dfinity/ic-build@sha256:ca256c678300a63897eaf2574c2d0044391fd1137b7a5e9b0f4224f9cd81d00a
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
 
diff --git a/.github/workflows/schedule-daily.yml b/.github/workflows/schedule-daily.yml
index ea0f97568334..5298e43f9762 100644
--- a/.github/workflows/schedule-daily.yml
+++ b/.github/workflows/schedule-daily.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:d7480d9e753f83ef8900edca2d45903d3f2215d2fba3367325c8bc6fc8f0de54
+      image: ghcr.io/dfinity/ic-build@sha256:ca256c678300a63897eaf2574c2d0044391fd1137b7a5e9b0f4224f9cd81d00a
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     timeout-minutes: 720 # 12 hours
diff --git a/.github/workflows/schedule-rust-bench.yml b/.github/workflows/schedule-rust-bench.yml
index 4daba6b940fb..66a6fb5bfd42 100644
--- a/.github/workflows/schedule-rust-bench.yml
+++ b/.github/workflows/schedule-rust-bench.yml
@@ -24,7 +24,7 @@ jobs:
       # see linux-x86-64 runner group
       labels: rust-benchmarks
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:d7480d9e753f83ef8900edca2d45903d3f2215d2fba3367325c8bc6fc8f0de54
+      image: ghcr.io/dfinity/ic-build@sha256:ca256c678300a63897eaf2574c2d0044391fd1137b7a5e9b0f4224f9cd81d00a
       # running on bare metal machine using ubuntu user
       options: --user ubuntu --mount type=tmpfs,target="/home/ubuntu/.local/share/containers"
     timeout-minutes: 720 # 12 hours
diff --git a/.github/workflows/schedule-weekly.yml b/.github/workflows/schedule-weekly.yml
index 7e9931e23bc3..13cf1eeebc02 100644
--- a/.github/workflows/schedule-weekly.yml
+++ b/.github/workflows/schedule-weekly.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:d7480d9e753f83ef8900edca2d45903d3f2215d2fba3367325c8bc6fc8f0de54
+      image: ghcr.io/dfinity/ic-build@sha256:ca256c678300a63897eaf2574c2d0044391fd1137b7a5e9b0f4224f9cd81d00a
       options: >-
         -e NODE_NAME --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     timeout-minutes: 60 # 1 hour
diff --git a/.github/workflows/update-mainnet-canister-revisions.yaml b/.github/workflows/update-mainnet-canister-revisions.yaml
index 4031c59ef3af..8ad8533e231b 100644
--- a/.github/workflows/update-mainnet-canister-revisions.yaml
+++ b/.github/workflows/update-mainnet-canister-revisions.yaml
@@ -25,7 +25,7 @@ jobs:
       labels: dind-small
     environment: CREATE_PR
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:d7480d9e753f83ef8900edca2d45903d3f2215d2fba3367325c8bc6fc8f0de54
+      image: ghcr.io/dfinity/ic-build@sha256:ca256c678300a63897eaf2574c2d0044391fd1137b7a5e9b0f4224f9cd81d00a
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     env:
diff --git a/ci/container/TAG b/ci/container/TAG
index 1cbfb8a07b42..0721b93644bc 100644
--- a/ci/container/TAG
+++ b/ci/container/TAG
@@ -1 +1 @@
-bac8d29032c99be57073c524f7f4c4cd9b91db27e796fc0a30792f1bd8f3160c
+f2f8e49dc06e75a1c684d9c5647fee0d0ef3084400bd45c4f268fad51a98252d
diff --git a/ci/container/files/packages.common b/ci/container/files/packages.common
index 80001fa3d294..1a9924124652 100644
--- a/ci/container/files/packages.common
+++ b/ci/container/files/packages.common
@@ -23,9 +23,6 @@ sudo
 jq
 rclone
 time
-podman # rosetta-release.yml
-rsync # container-base-images.yml
-lcov # used for bazel coverage
 
 # RUST
 gcc
@@ -64,6 +61,7 @@ libsystemd-dev
 libvirt-dev
 mtools # used for mcopy and mmd
 nasm # to build OVMF
+podman
 zstd
 
 # Unknown
diff --git a/ci/scripts/bazel-coverage.sh b/ci/scripts/bazel-coverage.sh
index 72e2aeb0cbc2..9b831b253204 100755
--- a/ci/scripts/bazel-coverage.sh
+++ b/ci/scripts/bazel-coverage.sh
@@ -1,6 +1,12 @@
 #!/usr/bin/env bash
 set -eEuo pipefail
 
+# Ensure lcov is installed
+if ! command -v lcov >/dev/null 2>&1; then
+    echo "lcov not found, installing..."
+    sudo apt-get update && sudo apt-get install -y lcov
+fi
+
 bazel query --universe_scope=//... \
     "kind(test, //rs/...) except kind(test, allrdeps(attr('tags', 'canister', //rs/...)))" \
     >cov_targets.txt